OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Port 65535
From: Murray, Mike (Mike.MurrayUTORONTO.CA)
Date: Thu Mar 02 2000 - 14:52:24 CST

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hey all...

        Been watching a rather strange scan of our Class C for the past week; I
don't know if I'd even call it a scan. Perhaps a misconfigured machine, or
something? Here's a log snippet:
Feb 29 07:12:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=15817 F=0x00B8 T=47
(#7)
Feb 29 07:14:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16104 F=0x00B8 T=47
(#7)
Feb 29 07:16:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16310 F=0x00B8 T=47
(#7)
Feb 29 07:18:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16430 F=0x00B8 T=47
(#7)
Feb 29 07:20:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16564 F=0x00B8 T=47
(#7)
Feb 29 07:22:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=16767 F=0x00B8 T=47
(#7)
Feb 29 07:24:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=17015 F=0x00B8 T=47
(#7)
Feb 29 07:26:25 firepower kernel: Packet log: private1 DENY eth0 PROTO=6
192.115.221.125:65535 207.245.232.127:65535 L=28 S=0x00 I=17227 F=0x00B8 T=47
(#7)

        I'm denying all of them at the firewall. I'm rather curious as to what
it is, though. The source is a machine in Israel, and, as of yesterday, the
scans were continuing on an intermittent basis. When it's happening, it sends
out a packet to our machine exactly every two minutes.

        Anybody have any idea on this one?

                                                Mike

- ----------------------------------
Message sent on 02-Mar-00 at 15:54:35

Mike Murray
Apt 1402
666 Spadina Ave
Toronto, ON
M5S 2H8

Phone: (416) 323-3160

        I can't think of anything pithy to say at
        all, today. So, I ramble.
- ----------------------------------

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.2

iQA/AwUBOL7VD4DBZTHOsqLmEQJNJACfagI24fOLNIjiyH8sRQ9VhUdGqU0AoPwa
mTR4DMdfuEIC9q30UubUW6L6
=wG8B
-----END PGP SIGNATURE-----