[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Tom Horsley wrote:
On Sat, 29 Dec 2007 22:35:07 +0800
Ed Greshko <[email protected]> wrote:

You forgot one very important item.

Whatever you do, don't be paranoid...unless someone is really out to get you.
All you need to do is leave an unsecured box hooked up to the internet
for 5 or 10 minutes to discover that someone really is out to get you :-).

Like these?
[[email protected] ~]# grep -i shore /var/log/messages | grep ppp0 | sed -r -e 's=.*IN\==IN\==' | sort -u -k 13 IN=ppp0 OUT= MAC= SRC=24.64.75.44 DST=58.6.192.22 LEN=512 TOS=0x00 PREC=0x00 TTL=67 ID=52497 PROTO=UDP SPT=8801 DPT=1026 LEN=492 IN=ppp0 OUT= MAC= SRC=24.64.75.44 DST=58.6.192.22 LEN=512 TOS=0x00 PREC=0x00 TTL=67 ID=52498 PROTO=UDP SPT=8801 DPT=1027 LEN=492 IN=ppp0 OUT= MAC= SRC=24.64.75.44 DST=58.6.192.22 LEN=512 TOS=0x00 PREC=0x00 TTL=67 ID=52499 PROTO=UDP SPT=8801 DPT=1028 LEN=492 IN=ppp0 OUT= MAC= SRC=60.190.118.200 DST=58.6.192.22 LEN=40 TOS=0x00 PREC=0x00 TTL=100 ID=6423 PROTO=TCP SPT=6000 DPT=1433 WINDOW=16384 RES=0x00 SYN URGP=0 IN=ppp0 OUT= MAC= SRC=60.190.38.34 DST=58.6.192.22 LEN=404 TOS=0x00 PREC=0x00 TTL=107 ID=3231 PROTO=UDP SPT=2795 DPT=1434 LEN=384 IN=ppp0 OUT= MAC= SRC=87.56.212.198 DST=58.6.192.22 LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=14821 DF PROTO=TCP SPT=1511 DPT=5900 WINDOW=65535 RES=0x00 SYN URGP=0 IN=ppp0 OUT= MAC= SRC=221.209.110.20 DST=58.6.192.22 LEN=485 TOS=0x00 PREC=0x00 TTL=47 ID=0 DF PROTO=UDP SPT=35334 DPT=1026 LEN=465 IN=ppp0 OUT= MAC= SRC=221.209.110.20 DST=58.6.192.22 LEN=485 TOS=0x00 PREC=0x00 TTL=47 ID=0 DF PROTO=UDP SPT=35334 DPT=1027 LEN=465 IN=ppp0 OUT= MAC= SRC=221.209.110.8 DST=58.6.192.22 LEN=485 TOS=0x00 PREC=0x00 TTL=47 ID=0 DF PROTO=UDP SPT=35712 DPT=1027 LEN=465 IN=ppp0 OUT= MAC= SRC=222.161.2.23 DST=58.6.192.22 LEN=918 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=UDP SPT=36413 DPT=1026 LEN=898 IN=ppp0 OUT= MAC= SRC=222.161.2.23 DST=58.6.192.22 LEN=918 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=UDP SPT=43810 DPT=1027 LEN=898 IN=ppp0 OUT= MAC= SRC=221.209.110.20 DST=58.6.192.22 LEN=485 TOS=0x00 PREC=0x00 TTL=47 ID=0 DF PROTO=UDP SPT=55025 DPT=1026 LEN=465 IN=ppp0 OUT= MAC= SRC=221.209.110.20 DST=58.6.192.22 LEN=485 TOS=0x00 PREC=0x00 TTL=47 ID=0 DF PROTO=UDP SPT=55025 DPT=1027 LEN=465
[[email protected] ~]#

Nah, they're not out to get me. They don't care who they get, so they're relatively easy to defeat.
If they were out to get me, they'd not be wasting time on sql-server, or 
those UDP ports 102[6-8].

I note that some sites I manage get significantly more of these scans than others.
--

Cheers
John

-- spambait
[email protected]  [email protected]
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375

You cannot reply off-list:-)


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]
  Powered by Linux