Netware performs port scan?

[Mentos]

Hi all,

Just for the record, I'm a novice at Netware...

Does anyone know why my Netware 5.1 server does a port scan on my computer after I altered the proxy settings for the GroupWise Administrator mailbox(in GroupWise from my PC)?

My personal firewall intercepted the port scan and identified the Netware IP address. I don't think my server is compromised, but if so where can I check this?

Thanx,
Mentos.

 

[Jontmke]

What ports? Netware servers use a few of them to check on the workstations connections.

Jon

There is much pleasure to be gained from useless knowledge. (Bertrand Russell)

 

[Mentos]

I can't really see which ports were scanned. My firewall blocks any attempt to scan more than 10 ports from 1 source IP. So Netware must have done more than that to get blocked...

The GroupWise app. opened 7 ports to listen on (2 TCP, 5 UDP). Only the 2 TCP ports have an open connection to NW on the GroupWise port, the UDP ports are open but seem to be unused.

 

[Jontmke]

That does not sound like a Novell server. It shouldn't be port scanning that many ports. Neither have I heard of a hacker making one for a Novell server, but it could be. Look on the console for what modules are running. There are a lot I know but try to see if there is one that could be doing this. Are you sure it was from the server IP address?

Jon

There is much pleasure to be gained from useless knowledge. (Bertrand Russell)