Port Scan

Port Scan Minor Incoming TCP 0.9.7.1 00-D0-BA-DA-76-01
Port Scan Minor Incoming TCP 3.2.3.7 00-D0-BA-DA-76-01
Port Scan Minor Incoming TCP 2.2.3.4 00-D0-BA-DA-76-01
Port Scan Minor Incoming TCP 1.2.3.4 00-D0-BA-DA-76-01
Port Scan Minor Incoming TCP 0.0.0.0 00-D0-BA-DA-76-01

Above are some IPs that are trying every minute to scan my ports as:

port 1025, 445, 3410 and port 6129

Please and need a help from you guys on how to deal with the above ips and others that i did not past them here.

I once laid a complaints on port scanning and really i got some assistance from this group, i still believe you will assist again... I dont want to be scanned again.

What measure will i take to get ride, report or block this activity?
What are the probably caurse of port scanning?

Thank You all and God bless us all.

First off, giving your IP out like ya just did isn't smart :p you shoulda masked it. Anyways, what OS are you running and do you have a firewall installed? If so, what are the settings?

Good day usmany,

It appears you have a firewall in place which is either dropping the packets or blocking them. The IP addresses you provided are European and you may be able to find out who they belong to by entering them in the following link:

http://www.ripe.net/db/whois/whois.html

For others, the free program called Sam Spade works pretty well and you can inquire about IP's by entering them in the address block and pressing the "whois" radio button. You can download that program at:

http://www.samspade.org/

Responses from both locations will usually have an abuse point of contact with an email address.
This works frequently, however some IPs may be spoofed and so locating the offender may be difficult to near impossible. But contacting the abuse point of contact may alert them to the reality that their computers are being used unlawfully

Continue to keep your firewall updated and have programs that detect and rid your computer of malware. Two programs that do a pretty good job of that are Adaware and Spybot S & D.

http://www.lavasoftusa.com/software/adaware/

http://www.safer-networking.org/index.php?page=download

If you haven't already installed an Anti-Virus program, you should have that as well.

All of these programs need to be kept updated frequently. There is not promise that this will make you completely safe on the Internet, however, it will definitely bring you closer to that goal.

You mention some speific ports they were scanning. You need to close all non-vital ports or stop all non-vital services. They're several web sites you can visit which will scan your computer to see which ports you may have open. The following site is one such:

http://www.grc.com

Two other programs of great value for keeping your computer clean are: CWShreader and Hyjackthis. You can use www.google.com to locate them. You will need to read up on them prior to using them because you could accidently delete some critical registry entrees by mistake.


If I can be of further assistance, please let me know.


cheers

Edit: another site for a security scan of your computer is: http://scan.sygate.com/

Are not my ips, they are the ips my firewall catched trying to scan my network and mac address... There is no way i will display my ip like that..

There is something wrong about those ips and mac address if you can fish out please and tell me what you suspect, commend and recommendation on what action to take.

Relyt, thank you very much on that information and i know you really asisted me much on that... I tarced back all the ips and i found same root you got and also found the abuse mail address which i did sent them mail and got an automated response.. I will wait and see if any reasonable and concern pers from any of the ips will response reasonably if not then I will look for another means of making them be aware of what is happening.

On issue of the ports, i will also do something on closing the ports and know what the ports are for...

I do have anti-virus that is always updating itself which I bought from mwti.net (micro world Inc.) I also have avg from grisoft.com and mcafee installed on my office system runing winme... fireware i am using is a software (sygate) and I also config mcafee firewall on some of the systems running it...

I will visit some of the site you gave me to download the other softwares and try.

Thanks

Good morning guys, hope we all had a wonderful night and day?

Mr. Relyt, i downloaded spybot software, installed and runed, is cool software and i do like it and its fuctions... I recommend to all users of antionline to try it too if they can.

All thanks goes to antionline discussion group for all asistance we give/render to one another. Also to members of Antionline.

Whatever software you're using is reporting "port scan" for something which is not doing a port scan.

Nearly all intrusion attempts since about 2001 have been from Windows worms. The owners of the machines are not (directly) responsible for their actions; most are entirely unaware of it.

You should configure your IDS to ignore common worms intrusions, because they are so common and it is so pointless to report them.

Personally I wouldn't even bother logging a connection attempt to a closed port 80, as it's created by so many worms, spiders, bots and anything else. Every IP on the internet gets many connection attempts per day.

Slarty

Actually it looks like the IPs may be spoofed, since differing IPs have the same MAC address.

Steve

steve.milner "Actually it looks like the IPs may be spoofed, since differing IPs have the same MAC address".

I think you are right since MAC Add are same.

Thanks guys

Ahem..... The MAC address in the packets reported is the MAC address of the last device the packet passed through, (probably a router), so it isn't an indicator of address spoofing.

However the 0.0.0.0 and 1.2.3.4 are pretty good indicators of spoofing. The first is a broadcast and it couldn't be replied to across the public network and the other is one hell of a coincidence.

Are you sure...

I managed to use a source MAC address to verify my mobile phone IMAP connection here:

http://www.antionline.com/showthread...ess#post709868

Doesn't it depend on what's being reported, or should I be rethinking my mobile phone IMAP connection and iptables?

Worried,
Steve

Steve:

It took me a while to find it and yes, this is talking about IPX routing and Broadcasts but that is on a different layer in the packet

Quote:

---

3. When the router receives the packet it builds a packet frame around it, and INSERTS the ROUTERS ethernet address as the MAC source address and leaves the MAC destination node address as FF's (broadcast datagram). The Transport control field in the IPX header is again incremented.

MAC Frame Changes: Ethernet Address: 00006E46A7F4 [Router's ethernet address]

---

Source

It was actually someone here on AO that originally pointed this out to me ages ago. The 802.3 MAC frame is where the change takes place in routed packets.

Tiger, I'm more confused..

You seen to be talking about IPX not TCP/IP as is the source article you quote.

I've tested my setup again and sniffed using ettercap after removing the iptables entry for a short while.

My phone service provider always shows a single IP for all GPRS connections (tested with my phone & a mates phone using the same phone service provider) but ettercap reports differing MAC addresses. Now since this is from the same service provider, using the same cell I can only assume that the routers the packets pass through (at least the last few of them) must be the same, so I am assuming this must be the MAC address of the phone.

The MAC address stays the same regardless of location of the phone within the UK.

The bottom line is my mate can't use me as an open relay, from the same phone service provider yet I can send email.

Steve

Steve: You are right.... I was in far too much of a hurry to be replying and wasn't really thinking about what the hell I was quoting/typing. I was right though when I typed it because I had already run a little experiment here. Now I have time to show the results.... :o

I have 2 routers on this subnet that sent traffic for my remote subnets in the appropriate directions.

Router 1: 00:e0:1e:42:a1:61
Router2: 00:50:73:44:0f:50

I have a subnets 192.168.101.0/24 and 192.168.103.0/24 routed through Router 1. 192.168.100.0/24 and routed through Router 1.

The router MAC's were determined by pinging them while Ethereal was running. The Ethereal dump shows the MAC address in Ethernet 2 part of the packet in the format "Source: 00:e0:1e:42:a1:61 (Cisco_44:0f:50)" for Router 1 and similar for Router 2.

I then ran a capture for any traffic coming from the 192.168.100.0/24 network. Looking at TCP/POP/DNS, (UDP), and HTTP packets the MAC address listed as source always has the "Source: 00:50:73:44:0f:50 (Cisco_44:0f:50)", (Router 2), in it regardless of the actual IP Address that initiated the packet on the remote subnet.

The same occurs with the other two subnets but the source then points to ""Source: 00:e0:1e:42:a1:61 (Cisco_44:0f:50), (Router 1).

In short, everything I see on this network from the remote networks has the local router's ethernet MAC as the source MAC in the Ethernet II part of the packets and Ethereal doesn't give any other MAC address other than the destionation, (in the same part of the Packet). IOW, this being a Cisco "shop", all my remote devices are reported as Cisco's - which they aren't.

I don't know what is happening on your phone but this is what is happening on my network and it gels with what I had pointed out to me in the past and even with the way the IPX packets are routed, (Aren't IPX packets only routed by encapsulation in TCP? Anyone?)..... The router places it's own MAC Address as the source....

You are spot on - I need to rethink my phone - mail security & to look at my experiments as well since they seemed to work!

I've just used ping to check this out.

The MAC address I've set up in iptables is for the router!

I'd give you more greens but I can't ATM!

Steve