LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices



Reply
 
Search this Thread
Old 01-01-2004, 09:09 PM   #1
Joey.Dale
Member
 
Registered: Jun 2003
Location: Tampa, Fl
Distribution: Gentoo, Slackware
Posts: 828

Rep: Reputation: 30
I think someone is scaning me


Hi all

I think someone is scaning my box, here is part f my incoming log, I need a 2nd oppion:
80.64.207.8 1080
80.64.207.8 3030
80.64.207.8 6588
80.64.207.8 3128
80.64.207.8 8080
80.64.207.8 23
80.64.207.8 1080
80.64.207.8 3030
80.64.207.8 6588
80.64.207.8 3128
80.64.207.8 8080
80.64.207.8 23
In goes on like that for a page and a half, it seems that they are only scaning 6 ports: alt. http, ssh, 1080, 3030, 6588, and 3228. Why would they only scan 6 ports and not scan for ftp and what is 1080, 3030, 6588, and 3228?

Thank you

-Joey
 
Old 01-01-2004, 10:34 PM   #2
KingofBLASH
Member
 
Registered: Sep 2003
Distribution: Just upgraded to Slackware 10.0
Posts: 91

Rep: Reputation: 15
Somebody probably is scanning you. I've got about a half dozen computers on my ISP's network that always look at my computer to see whether or not I'm running an insecure IIS server. I've reported it several times and my ISP (road runner) has yet to pull the plug on them.

So, in short, scanning happens and there's no way around it. Why they haven't scanned for FTP depends on exactly what diabolical deeds they are planning. I would encourage you to traceroute the IPs and send a complaint to abuse@their.isp
 
Old 01-01-2004, 10:40 PM   #3
Joey.Dale
Member
 
Registered: Jun 2003
Location: Tampa, Fl
Distribution: Gentoo, Slackware
Posts: 828

Original Poster
Rep: Reputation: 30
Thank you
 
Old 01-01-2004, 10:59 PM   #4
w0000422
Member
 
Registered: Dec 2003
Distribution: redhat linux 9.0
Posts: 60

Rep: Reputation: 15
how to check somebody was scanning u?
 
Old 01-01-2004, 11:09 PM   #5
Joey.Dale
Member
 
Registered: Jun 2003
Location: Tampa, Fl
Distribution: Gentoo, Slackware
Posts: 828

Original Poster
Rep: Reputation: 30
veiwing my incoming logs
 
Old 01-01-2004, 11:36 PM   #6
Lost Penguin
Member
 
Registered: Feb 2003
Location: Orlando, FL
Distribution: 2.6.1-1.131smp on Fedora Core 1
Posts: 31

Rep: Reputation: 15
Re: Scanning

In goes on like that for a page and a half, it seems that they are only scaning 6 ports: alt. http, ssh, 1080, 3030, 6588, and 3228. Why would they only scan 6 ports and not scan for ftp and what is 1080, 3030, 6588, and 3128?

I do not know all the ports you list OTMH, but 3128 is Squid proxy, that 3128 scan is looking for a open proxy.
 
Old 01-02-2004, 06:20 PM   #7
vectordrake
Senior Member
 
Registered: Nov 2003
Location: NB,Canada
Distribution: Something alpha or beta, binary or source...
Posts: 2,280
Blog Entries: 4

Rep: Reputation: 47
1080 is SOCKS, 3030 lists as Arepa Cas.(dunno either), 3028 is LiebDevMgmt_DM., 6588 is unassigned. Perhaps someone is trying to use your machine as a proxy so they will be untracable to their intended victim. Just a guess. Report the meanines!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Scaning disk mp4-10 Linux - Software 3 03-22-2005 11:40 AM
scaning usb ports in terminal wisdom Linux - Hardware 3 12-30-2004 09:42 PM
are there any tools for scaning windows partition with windows virus... hkl8324 Linux - Newbie 1 08-04-2004 03:23 PM
Postfix/amavisd-new virus scaning only thesnaggle Linux - Software 0 12-16-2003 11:08 AM


All times are GMT -5. The time now is 08:28 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration