networking/port scanning question
i was reading this paper and part of it confused me about port scanning and stuff. it said:
Quote:
On 27 April, at 00:13 hours, our network was scanned by the system 1Cust174.tnt2.long-branch.nj.da.uu.net for several vulnerabilities, including imap. Our intruder came in noisy, as every system in the network was probed.
Apr 27 00:12:25 mozart imapd[939]: connect from 208.252.226.174
Apr 27 00:12:27 bach imapd[1190]: connect from 208.252.226.174
Apr 27 00:12:30 vivaldi imapd[1225]: connect from 208.252.226.174
how could he scan every system on the network from outside the network? if the computers on the internet are connected to the internet, wouldnt they have to be behind some kind of router or hub that would make it impossible for him to scan them from outside?
heres the page: http://project.honeynet.org/papers/enemy3/
Re: networking/port scanning question
Quote:
Originally posted here by Phonedog911
i was reading this paper and part of it confused me about port scanning and stuff. it said:
how could he scan every system on the network from outside the network? if the computers on the internet are connected to the internet, wouldnt they have to be behind some kind of router or hub that would make it impossible for him to scan them from outside?
heres the page: http://project.honeynet.org/papers/enemy3/
Unfortunately not, there are many places that run without the benefit of firewalls or router's doing NAT or using access lists. I would beg to differ about their use of terminology, a port scan is hardly iindicative of 'several vulnerabilities.' It looks to me based on it that it is just run of the mill port scanning for imap...barely even noteworthy.
Also note, your source is the honeynet project, which is specifically dedicated to 'luring' hackers into specially constructed traps that are desinged to analyze their techniques and tools and to get an idea of what people are looking for. I would not be suprised to see a honeynet system wide open to the world. Was that quote from honeynet too? I am a little surpised they would use that kind of terminology...
