AmeritecTech
Change we can believe in, 1922
Premium
join:2002-09-06
Houston, TX
| reply to Armada1
Re: Virus Scanning and Your Redback
That's generally because someone using a port scanner scans the range he is on first. The likelihood that someone in another range will guess your range is unlikely, but eventually you'll see some of that too. If you're interested in seeing how a port scanner works, try YAPS, Yet Another Port Scanner.
»www.tni.net/~ted/Yaps/Yaps.html
Fun to play with, but be good! |
|
Armada1
Heat Miser
join:2001-05-16
Chicago, IL
| reply to AmeritecTech
said by AmeritecTech  :
Port scans are common on the internet. If you've got a firewall, its nothing to worry about.
No, I was just wondering about only getting barraged by them from the same ip range I am on, but no others.
--
Formerly the Snow Miser... |
|
AmeritecTech
Change we can believe in, 1922
Premium
join:2002-09-06
Houston, TX | reply to Armada1
Port scans are common on the internet. If you've got a firewall, its nothing to worry about. |
|
Armada1
Heat Miser
join:2001-05-16
Chicago, IL
| reply to RadioDoc
said by RadioDoc :
There is no filtering. You just happened to have one of these worm-infected turkeys on each subnet. My server error logs are full of this crap, and I don't even bother to look at it anymore.
I just check it every now and then for new stuff...
There are a lot of worm-infected turkeys on each subnet...
--
Formerly the Snow Miser... |
|
RadioDoc
58ef2c0
Premium,ExMod 2000-03
join:2000-05-11
 ·AT&T Midwest
| reply to Armada1
There is no filtering. You just happened to have one of these worm-infected turkeys on each subnet. My server error logs are full of this crap, and I don't even bother to look at it anymore.
--
May you always be as vivid as your hallucinations. |
|
Armada1
Heat Miser
join:2001-05-16
Chicago, IL
| For a week or so my ip was 68.73.xx.xx. My logs were filled with .../default.ida XXXXXXXXXXX... scans from ips in the 68.73 range. Recently my ip changed to 68.78.xx.xx Now my logs are filled with .../default.ida XXXXXXXXXXX... scans from 68.78 machines (No not my own machines!) No other similar scans from any other ip range. Different scans yes, but not the .../default.ida worm (code whatever)
My guess is that filtering of this is going on, but my question is, how does this filtering affect normal port 80 traffic from reaching my websites? One is very Chicago centric and my bet would be that many potential viewers would be on the same redback as I am.
Any thoughts?
--
Formerly the Snow Miser... |
|
