Re:Port Scanning
Al Kirk <ak...@pacific.net> schreef in berichtnieuws
3C093578.C9441...@pacific.net...
Quote
> This may not be appropriate, but FYI:
> This is the response from Technical Support at readyhosting.com when
informed that their hosting software was performing Netbios
Quote
> Name scanning.
> Customer Ticket Detail for Ticket 14545
> Current Status Completed
> DomainName x...@yyyy.net
> Time in Queue 1119 Min. Elapsed
> I believe you host these sites.
> Yesterday, reported by Zone Alarm:
> The firewall has blocked Internet
> access to your computer (NetBIOS
> Name) from
> www.sandbrooksoftware.com
> (63.119.175.18) (NetBIOS Name).
> Other Data Time: 11/29/2001 15:46:06 (PST)
> Today: The firewall has blocked
> Internet access to your computer
> (NetBIOS Name) from
> www.delphicollection.com
> (63.99.209.23) (NetBIOS Name).
> Time: 11/30/2001 16:43:30 (PST)
> Why are you netbios-name scanning?
> Completed By Mike Herbrechtsmeier
> You will have to check your
> Actions Taken firewall settings. I am able to
> To Complete access your domains from our
> servers. Thank you
I cannot comment on readyhosting.com, but if you are on a dialup-line, then
there is another possible - and mostly harmless- cause for these ZoneAlarm
alerts. When you dial in, you get a temporary IP-adress from your ISP's
IP-block. Especially on peak hours, this will be the IP-address from
another user that has hung up just before you dialed in. Depending on what
this user was doing on the internet, and his network settings, _you_ will
now receive all the garbage of closing socket connections etc...
Most ZoneAlarm alerts fall in this category.
A true port scan otoh, will trigger ZA many times in succession, with
incrementing port numbers. ( they mostly stop immediately if you ping back a
few times <g> )
--
Regards,
Dirk Claessens
---------------------------------------------------------
http://www.claessens16.yucom.be
Attention: All spamshields raised; E-mails will bounce!
---------------------------------------------------------