OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Spoofed IP port scan?
From: Dave Chen (Dave_ChenACML.COM)
Date: Tue Nov 14 2000 - 15:42:57 CST

Hi,

         I notice an increase in scanning for sunrpc, telnet,
ftp, etc for a range of IPs (that include our hosts in that IP
range). I've notify the ISP of the source address. One ISP
stated that they could not find the corresponding activity in
their external router, indicating the IP could be spoofed.
         Question: If the IP is spoofed, how can the hacker get
the port scan information? They either have to be on my up
stream ISP or the up stream of the source IP to the scan results,
right?

Dave Chen CISSP