Board index » delphi » Port Scanning

Port Scanning

This may not be appropriate, but FYI:

This is the response from Technical Support at readyhosting.com when informed that their hosting software was performing Netbios
Name scanning.

 Customer Ticket Detail for Ticket 14545
 Current Status  Completed
 DomainName      x...@yyyy.net
 Time in Queue   1119 Min. Elapsed

                 I believe you host these sites.
                 Yesterday, reported by Zone Alarm:
                 The firewall has blocked Internet
                 access to your computer (NetBIOS
                 Name) from
                 www.sandbrooksoftware.com
                 (63.119.175.18) (NetBIOS Name).
 Other Data      Time: 11/29/2001 15:46:06 (PST)
                 Today: The firewall has blocked
                 Internet access to your computer
                 (NetBIOS Name) from
                 www.delphicollection.com
                 (63.99.209.23) (NetBIOS Name).
                 Time: 11/30/2001 16:43:30 (PST)

                 Why are you netbios-name scanning?

 Completed By    Mike Herbrechtsmeier

                 You will have to check your
 Actions Taken   firewall settings. I am able to
 To Complete     access your domains from our
                 servers. Thank you

 

Re:Port Scanning


Al Kirk <ak...@pacific.net> schreef in berichtnieuws
3C093578.C9441...@pacific.net...
Quote
> This may not be appropriate, but FYI:

> This is the response from Technical Support at readyhosting.com when

informed that their hosting software was performing Netbios

Quote
> Name scanning.

>  Customer Ticket Detail for Ticket 14545
>  Current Status  Completed
>  DomainName      x...@yyyy.net
>  Time in Queue   1119 Min. Elapsed

>                  I believe you host these sites.
>                  Yesterday, reported by Zone Alarm:
>                  The firewall has blocked Internet
>                  access to your computer (NetBIOS
>                  Name) from
>                  www.sandbrooksoftware.com
>                  (63.119.175.18) (NetBIOS Name).
>  Other Data      Time: 11/29/2001 15:46:06 (PST)
>                  Today: The firewall has blocked
>                  Internet access to your computer
>                  (NetBIOS Name) from
>                  www.delphicollection.com
>                  (63.99.209.23) (NetBIOS Name).
>                  Time: 11/30/2001 16:43:30 (PST)

>                  Why are you netbios-name scanning?

>  Completed By    Mike Herbrechtsmeier

>                  You will have to check your
>  Actions Taken   firewall settings. I am able to
>  To Complete     access your domains from our
>                  servers. Thank you

I cannot comment on readyhosting.com, but if you are on a dialup-line, then
there is another possible - and mostly harmless- cause for these ZoneAlarm
alerts. When you dial in, you get a temporary IP-adress from your ISP's
IP-block. Especially on peak hours,  this will be the IP-address from
another user that has hung up just before you dialed in. Depending on what
this user was doing on the internet, and his network settings, _you_ will
now receive all the garbage of closing socket connections etc...
Most ZoneAlarm alerts fall in this category.
A true port scan otoh, will trigger ZA many times in succession, with
incrementing port numbers. ( they mostly stop immediately if you ping back a
few times <g>  )

--
Regards,

Dirk Claessens
---------------------------------------------------------
http://www.claessens16.yucom.be
Attention: All spamshields raised; E-mails will bounce!
---------------------------------------------------------

Re:Port Scanning


I considered that.  They say it is not happening, I trust Zone Alarm. I've left email for sales at readyhosting, waiting for
response.  It appears to happen after I leave one of their hosted sites which I'm visiting for the first time.
The the exception was the first scan, which presumably could have been leftover from a previous connection as you mention, however I
had been continuously connected for 7 hours before it happened.
I'll post whatever they respond.
Quote
Dirk Claessens wrote:

> Al Kirk <ak...@pacific.net> schreef in berichtnieuws
> 3C093578.C9441...@pacific.net...
> > This may not be appropriate, but FYI:

> > This is the response from Technical Support at readyhosting.com when
> informed that their hosting software was performing Netbios
> > Name scanning.

> >  Customer Ticket Detail for Ticket 14545
> >  Current Status  Completed
> >  DomainName      x...@yyyy.net
> >  Time in Queue   1119 Min. Elapsed

> >                  I believe you host these sites.
> >                  Yesterday, reported by Zone Alarm:
> >                  The firewall has blocked Internet
> >                  access to your computer (NetBIOS
> >                  Name) from
> >                  www.sandbrooksoftware.com
> >                  (63.119.175.18) (NetBIOS Name).
> >  Other Data      Time: 11/29/2001 15:46:06 (PST)
> >                  Today: The firewall has blocked
> >                  Internet access to your computer
> >                  (NetBIOS Name) from
> >                  www.delphicollection.com
> >                  (63.99.209.23) (NetBIOS Name).
> >                  Time: 11/30/2001 16:43:30 (PST)

> >                  Why are you netbios-name scanning?

> >  Completed By    Mike Herbrechtsmeier

> >                  You will have to check your
> >  Actions Taken   firewall settings. I am able to
> >  To Complete     access your domains from our
> >                  servers. Thank you

> I cannot comment on readyhosting.com, but if you are on a dialup-line, then
> there is another possible - and mostly harmless- cause for these ZoneAlarm
> alerts. When you dial in, you get a temporary IP-adress from your ISP's
> IP-block. Especially on peak hours,  this will be the IP-address from
> another user that has hung up just before you dialed in. Depending on what
> this user was doing on the internet, and his network settings, _you_ will
> now receive all the garbage of closing socket connections etc...
> Most ZoneAlarm alerts fall in this category.
> A true port scan otoh, will trigger ZA many times in succession, with
> incrementing port numbers. ( they mostly stop immediately if you ping back a
> few times <g>  )

> --
> Regards,

> Dirk Claessens
> ---------------------------------------------------------
> http://www.claessens16.yucom.be
> Attention: All spamshields raised; E-mails will bounce!
> ---------------------------------------------------------

Other Threads