LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 12-16-2002, 09:06 AM   #1
WeNdeL
Member
 
Registered: Oct 2002
Location: At my desk...
Distribution: RedHat, Fedora, Ubuntu
Posts: 344

Rep: Reputation: 30
Question So whats all this mean to me?


My department has recently set up a new mail server. My supervisor has the kernel logwatch being forwarded to me and I am unsure of what to make of the output. A lot of it looks like random ppl trying to poke and prod the box for certain open ports. Now what I am most curious about are entries like these:


Denied packets from vmb-ext.prodigy.net (207.115.63.87).
Port 2305 (tcp,eth0,input): 6 packet(s).
Port 2283 (tcp,eth0,input): 7 packet(s).
Port 2131 (tcp,eth0,input): 8 packet(s).
Port 2238 (tcp,eth0,input): 4 packet(s).
Port 2349 (tcp,eth0,input): 10 packet(s).
Port 2162 (tcp,eth0,input): 9 packet(s).
Port 2206 (tcp,eth0,input): 8 packet(s).
Total of 52 packet(s).

Denied packets from vmg-ext.prodigy.net (207.115.63.93).
Port 2347 (tcp,eth0,input): 10 packet(s).
Port 2160 (tcp,eth0,input): 8 packet(s).
Port 2204 (tcp,eth0,input): 4 packet(s).
Port 2303 (tcp,eth0,input): 8 packet(s).
Port 2281 (tcp,eth0,input): 9 packet(s).
Port 2240 (tcp,eth0,input): 6 packet(s).
Port 2129 (tcp,eth0,input): 8 packet(s).
Total of 53 packet(s).

Denied packets from vmd-ext.prodigy.net (207.115.63.89).
Port 2301 (tcp,eth0,input): 8 packet(s).
Port 2228 (tcp,eth0,input): 6 packet(s).
Port 2335 (tcp,eth0,input): 10 packet(s).
Port 2141 (tcp,eth0,input): 6 packet(s).
Port 2273 (tcp,eth0,input): 8 packet(s).
Port 2214 (tcp,eth0,input): 6 packet(s).
Port 2179 (tcp,eth0,input): 4 packet(s).
Total of 48 packet(s).

Denied packets from vm7-ext.prodigy.net (207.115.63.121).
Port 2338 (tcp,eth0,input): 8 packet(s).
Port 2139 (tcp,eth0,input): 6 packet(s).
Port 2272 (tcp,eth0,input): 6 packet(s).
Port 2217 (tcp,eth0,input): 9 packet(s).
Port 2178 (tcp,eth0,input): 6 packet(s).
Port 2300 (tcp,eth0,input): 9 packet(s).
Port 2227 (tcp,eth0,input): 8 packet(s).
Total of 52 packet(s).

Denied packets from vmi-ext.prodigy.net (207.115.63.96).
Port 2241 (tcp,eth0,input): 8 packet(s).
Port 2181 (tcp,eth0,input): 10 packet(s).
Port 2339 (tcp,eth0,input): 6 packet(s).
Port 2296 (tcp,eth0,input): 8 packet(s).
Port 2208 (tcp,eth0,input): 6 packet(s).
Port 2145 (tcp,eth0,input): 6 packet(s).
Port 2269 (tcp,eth0,input): 8 packet(s).
Total of 52 packet(s).

Denied packets from vmh-ext.prodigy.net (207.115.63.97).
Port 2299 (tcp,eth0,input): 8 packet(s).
Port 2275 (tcp,eth0,input): 9 packet(s).
Port 2216 (tcp,eth0,input): 6 packet(s).
Port 2177 (tcp,eth0,input): 9 packet(s).
Port 2230 (tcp,eth0,input): 6 packet(s).
Port 2337 (tcp,eth0,input): 8 packet(s).
Port 2137 (tcp,eth0,input): 9 packet(s).
Total of 55 packet(s).

And so on... my box has been hit by someone from the 207.115.63 network for the past few days. Are they slowly port scanning me? What should I make of this?

I am also seeing a lot of these as well:

Denied packets from performance-104.sef.pnap.net (63.251.161.104).
Port 0 (icmp,eth0,input): 6 packet(s).
Total of 6 packet(s).

Denied packets from performance-test-67.lax.pnap.net (216.52.254.67).
Port 0 (icmp,eth0,input): 6 packet(s).
Total of 6 packet(s).

Denied packets from performance-test-72.lax.pnap.net (216.52.254.72).
Port 0 (icmp,eth0,input): 6 packet(s).
Total of 6 packet(s).

Denied packets from performance-233.nyc.pnap.net (216.223.48.233).
Port 0 (icmp,eth0,input): 8 packet(s).
Total of 8 packet(s).

Any ideas of what this is all about. I am new to the sysadmin realm and don't know a whole lot about security.

Thanks in advance...
 
Old 12-16-2002, 10:02 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,372
Blog Entries: 54

Rep: Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870
From the name I would venture performance-test.*lax.pnap.net are some sort of Akamai-like outfit trying to serve pages from a close by location or something like that.

The logwatches don't mean a thing to me.
If the port mentioned are ports local to the box, my portdb shows 3 hits:
]$ port 2305
2305/tcp mt-scaleserver MT ScaleServer
2305/udp mt-scaleserver MT ScaleServer
]$ port 2238
2238/tcp aviva-sna AVIVA SNA SERVER
2238/udp aviva-sna AVIVA SNA SERVER
]$ port 2349
2349/tcp redstorm_diag Diagnostics Port
2349/udp redstorm_diag Disgnostics Port
..which don't mean a thing if you ain't running those.
Btw, are these packets per second or what?
Do you have legitimate business (traffic) with .*ext.prodigy.net?
If the packets are logged, but the system ain't running anything on those ports and the packets haven't got bad flags, why ain't they silently discarded?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
whats this mean? slinky2004 Linux - Newbie 3 10-09-2005 12:04 PM
whats next wesw02 Linux - Newbie 4 12-28-2004 12:17 PM
whats up with this?? A.D.D. Linux - Newbie 4 10-08-2004 01:47 AM
Whats this butface Linux - Newbie 4 08-25-2003 03:41 PM
Whats the Best?...... andyjenk Linux - Newbie 8 09-16-2002 09:02 PM


All times are GMT -5. The time now is 04:07 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration