portscan? what is it?

I was surfing the Net tonight and my Norton firewall came up with a message saying that an intruder had been stopped trying to get into my computer. Now, I'm kind of new with this security stuff. Norton told me that the attack was a "portscan". So what I need to know is exactly what is a portscan, and how much of a threat is it? I ran the IP address from the offending computer on this site, and it came back to somewhere in France. It didn't give an ISP or anything like that. The trace didn't get more specific than the country. So, do I have anything to worry about here?

Probably not, as long as your firewall is doing its job. A port scanner is a program that scans computer networks for hosts (computers) with open ports. Basically, it does this by trying to make connections with your computers ports. If your firewall is set to block these connection attempts you should be ok. If your firewall is properly configured, and you aren't running any services (and allowing incoming connections), the scanner will probably never know that you are there. I wouldn't worry about it unless you keep getting scans from the same ip.

Well, probably someone in your local network is interested in your open ports, services, etc. They could find any potential vulnerability. I suggest consultin Google on how to close open ports. It includes process diabling and registry browsing.

well somefilename. he's running a firewall (its what told him about the "attempt" in the first place...) so chances are if there are any network accessable ports, chances are he wants them open, as most firewalls will block any ports and applications unless explicitly allowed.

Thanx for the info. I googled the IP address, and it seems like other ppl have gotten pinged by it too, w/ no harmful effects. Another question for you experts out there, why would a random computer from another country be looking for open ports on my laptop?

Its not the random computer looking for open ports - its the random person sitting behind the random computer thats looking for them!

There must be millions of people who download [easily available] port scanners and just start scanning away at IP ranges - but only, probably hundereds, who know what to do when they find an open port!

Dont worry about it, as long as your firewall is doing its job - which it is - you are pretty safe!

Quote:

---

Originally posted by Xenoborg2001:

why would a random computer from another country be looking for open ports on my laptop?

---

I seriously doubt that you were targeted specifically... Some people just scan until they find the weakness that their prewritten exploits will take advantage of... these people are generally called script kiddies...

Here is a thread on the same topic as yours. Have a look

http://www.antionline.com/showthread...hreadid=273181

Reconnaissance is the first thing that an attacker will do to find a juicey target. Port scans (aka port knocking) is only one form of recon (war-dialing is another example) and it serves the purpose of revealing what services the target host has wide open.

Once an attacker finds open ports such as NetBios or FTP they will do some research about the open ports to see if any vulnerabilities exist and if so, will come back later with the right tool to compromise your system.

In a lot of cases the attacks are spoofed, meaning, the attacker has either compromised another system and is attacking you from there or else they are using phoney source IP addresses to cause a condition whereby your system becomes completely "owned" by them and they can re-visit anytime and your system will be the next porn mirror or point of attack.

Quote:

---

There must be millions of people who download [easily available] port scanners and just start scanning away at IP ranges

---

Ummm no... the idea that some "script-kiddie" is going to use nmap and then push the results to exploit.exe just doesn't happen. And I blame those classes or 101 portions of cons for telling people otherwise. The idea is that you have bots to take the work-load and not the other way around.

Quote:

---

Originally posted here by aciscorouter
... Port scans (aka port knocking) is only one form of recon ...

---

As far as I'm concerned, port knocking is not equivalent to port scanning.

Please see these articles:

http://en.wikipedia.org/wiki/Port_scanning
http://en.wikipedia.org/wiki/Port_knocking

Quote:

---

... port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of connection attempts is received the firewall rules are dynamically modified to allow the host which sent the connection attempts to connect over specified port(s).

---

Regards,

Anal aL

Quote:

---

Originally posted here by alleyCat
As far as I'm concerned, port knocking is not equivalent to port scanning.

---

I defo stand corrected on this one. I have misused the meaning in the past and have recently read that very article on Port Knocking that you referred me to, but obviously hadn't digested it. :confused: Thanks for correcting me. I won't be mixing these terms ever again :p

what is this port scan you are talking about ?
how do you do it ?

As alleyCat suggested earlier:

Portscanning
From Wikipedia , the free encyclopedia
Jump to: navigation, search
A Port Scan is one of the most popular reconnaissance techniques attackers use to discover services they can break into. All machines connected to a Local Area Network (LAN) or Internet run many services that listen at well-known and not so well known ports. A port scan helps the attacker find which ports are available (i.e., what service might be listing to a port). Essentially, a port scan consists of sending a message to each port, one at a time. The kind of response received indicates whether the port is used and can therefore be probed further for weakness.

Retrieved from "http://en.wikipedia.org/wiki/Portscanning"

There are a number of tools and tutorials to do port-scans. Some are quite polite and some are quite aggressive.

Here are two examples at either end of the spectrum (there are thousands of variants out there):
SuperScan (recently aquired by FoundStone)
Nmap or Nmapwin (the first is for *NIX and the second is for, you guessed it, Windows)

an operating systems uses ports in order to allow applications run across some type of medium. For example, there is a port for POP3 which is 110, SMTP with is 25; 80 HTTP; 8080 HTTPS; etc...

You can either point a port scanner a specific IP address or a scope of IP Addresses to find open ports TCP & UDP. Now that someone knows which ports are open, they can attempt to gain access to your workstation through that port.

There are ways to get in, but I"m not that knowledable on the subject, so I better just leave it alone.

Guess the rule of thumb is, keep track of what ports you use; block the ones you don't and if you are able, specify your own ports. Since you're using a firewall, place close attention to software you allow to access the internet. Each time you allow the software, you're opening up a port for it.

Damn, I think I just went off subject.