This so-called "port scanning" business

K

Kei

Banned
Joined
Jul 10, 2004
Messages
1,220
Reaction score
0
Has anyone else noticed a marked increase in port scans this week.

I keep noticing the router logs full of attempts at port accesses coming all from 196.2.xxx.xxx IP ranges. It's defnitely increased in volume. I'm also seeing security alerts on the router, which appear to be DoS attacks. All my computers are currently off!

Anyone else seeing this ****?
 
Get my usual 1500 - 1800 firewall hits per day, so far 800 today, which is actually sub-normal. Snort IDS entries sit on 8 so far, normally 20 - 35 per day. The bulk of the hits are normally from WBS / iBurst IP's.
 
theres a way to tell if its a ddos or a port scan aside from the face one will try knock you off the net. if the connections it attempts are half opened tcp ones, or if its alot of tcp ports its a portscan if its udp its a ddos.

alot of it is pretty automated just bots scanning for vulnerable hosts, you should be OK
 
Thank you

I don't normally worry about this but I've come home twice this week and found my router was frozen i.e. had to reset it and the bloody thing e-mails me with security alerts- never used to do that...
 
i've had 10598 blocked inbound events this month so far according to Mcafee Firewall... and 99% of them have a 196.2.x ip...

should we see what happens when we switch off our firewalls n stuff? :D
 
Crash said:
"Switch off our firewalls n Stuff"
Click to expand...
That's what I've been told by the helldesk guy 30 minutes ago when I got continuous auth failures from IPCop... :eek:
 
I am not switching off any filtering on my router. Sorry I've been hacked in the past and I am not taking that chance again.

I would much rather live with having to reset the router once a day
 
auth attempts failed beens you have been "disconnected" and are not alowed back on do to some weird overcrowding rules by wbs. Its got nothing to do with ipcop try with out it it still won't work. The helpdesk will blame anything they can, give em a linux firewall box and they will say "iburst doesn't like linux". What a joke.

You probably on the edge of the coverage and they take preference on users "closer to tower" the only ways to get around this is a stronger / better positioned arial or new tower or WBS changing the logic (not ganna happen).

I still have issues
 
Tx, got terribly upset because I was moving data between outside servers and this really got me. This weekend was a total disaster for me with continuous disconnections...

The weird thing is that it fixed itself after about 45 minutes, I'm less than 1 km from the tower (see it clearly on the hill above my house), the worst signal that I've seen is -74 dBm and, according to Sasan himself, this is one of the towers with the lowest load, so it was obviously something with their system.
BTW, restarted IPCop, tried FC3 too and WinXP with ethernet & USB and did rfScan before calling helldesk :)
 
This weekend iBurst sucked ass royally.

Constant disconnections, p2p doesn't work at all now... overall **** experience
 
P2p worked for you before? hasnt worked for me for a long time...
 
Now I'm gatvol with 196.2.x.x and many others port scanning my PC
These looks like WBS IP's

Any advice or just leave the clown to keep on trying?
 
I once started a thread about this. There was a mother load of attempts from that IP range.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X