Being scanned on a wide range of ports....

[Georgi1chuikov]

My router has been recieving an unusual amount of random scans from what seem to be a partially spoofed IP address. This scanner is choosing a range of about 100 ports.Sometines in the 1500 range, sometimes in the 2000 range. today it is in the 2500 range. I get several hundred port scans a day from this source and I am pretty sure it is a spoofed address that always has the IP of 209.249.123.xxx (x is the same for 200 or so scans and then changes) Any one have any advice? Is there any action a need to take?

 

[Sapient2003]

If the IP address is being spoofed, the alleged attacker wouldn't get any responses from your computer, so that is out of the question. The attacker could go through a sock/proxy server, but for port scanning, it wouldn't be worth the hastle as port scanning is legal in the United States. You can use the abuse reporting system on the attacker's ISP to resport the port scanning if it continues.

--Sapient2003 - sapient@sapient2003.com
"The worst insecurity is believing you are too secure."

 

[chiph]

Not much you can do. If you start legal action you're likely to be attacking the wrong person (since the IP address changes so often, you can be pretty sure it's faked).

Chip H.


If you want to get the best response to a question, please check out FAQ222-2244 first

 

[happytom]

Sapient2003 is right, if this is a spoofed IP then the attacker will never know what is happening since the spoofed ip is not his ip. What you will want to do is take a log of what is happening and see where it is comming from. Do a WhoIs on the addresses and find out if they belong to a university. What is the address of your ISP, they might be scanning your network to see what illegal ports are open. Is this a home based computer??? Then get a network firewall and have an internal NAT, then turn off all non used ports. If you want to be clever then make a Linux box, put it in the DMZ of the firewall and activate all the auditing that you can. Look at the logs to see if the same IP ever does the same scanning a bunch of times. If the attacker gets lazy then they might start useing the same IP address. Do some investigation on the addresses to see if they come from the same subnet, if they do send an email to the abuse@ISP-email-address with the logs that you have.

Hapy

Last night I lay in bed looking up at the stars in the sky and I thought to myself, where the hell is the ceiling?