LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 04-09-2004, 12:35 AM   #1
bishal
LQ Newbie
 
Registered: Feb 2004
Location: Nepal
Posts: 25

Rep: Reputation: 15
IS someone scanning my server?


Hello linux Gurus,

Can anyone tell me what does this message means which is generated by in my log. Is someone trying to attack my server? Below is the copy of scan logged messages. I have unmasked the DST ip of my server for security reason, sorry. Please help me,

-------------------------------------------------------------------------

Mar 30 01:09:57 squid-proxy kernel: IN=eth0 OUT= MAC=00:c0:26:89:5c:d8:00:30:1d:00:a3:d1:08:00
SRC=218.79.115.169 DST=xxx.xxx.xxx.xxx LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=17316 DF
PROTO=TCP SPT=3508 DPT=8081 WINDOW=64800 RES=0x00 SYN URGP=0
Mar 30 01:09:57 squid-proxy kernel: IN=eth0 OUT= MAC=00:c0:26:89:5c:d8:00:30:1d:00:a3:d1:08:00
SRC=218.79.115.169 DST=xxx.xxx.xxx.xxx LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=17317 DF
PROTO=TCP SPT=3507 DPT=8080 WINDOW=64800 RES=0x00 SYN URGP=0
Mar 30 01:09:57 squid-proxy kernel: IN=eth0 OUT= MAC=00:c0:26:89:5c:d8:00:30:1d:00:a3:d1:08:00
SRC=218.79.115.169 DST=xxx.xxx.xxx.xxx LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=17318 DF
PROTO=TCP SPT=3506 DPT=808 WINDOW=64800 RES=0x00 SYN URGP=0
Mar 30 01:09:57 squid-proxy kernel: IN=eth0 OUT= MAC=00:c0:26:89:5c:d8:00:30:1d:00:a3:d1:08:00
SRC=218.79.115.169 DST=xxx.xxx.xxx.xxx LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=17322 DF
PROTO=TCP SPT=3510 DPT=8263 WINDOW=64800 RES=0x00 SYN URGP=0
Mar 30 01:09:58 squid-proxy kernel: IN=eth0 OUT= MAC=00:c0:26:89:5c:d8:00:30:1d:00:a3:d1:08:00
SRC=218.79.115.169 DST=xxx.xxx.xxx.xxx LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=17368 DF
PROTO=TCP SPT=3511 DPT=8403 WINDOW=64800 RES=0x00 SYN URGP=0
Mar 30 01:09:58 squid-proxy kernel: IN=eth0 OUT= MAC=00:c0:26:89:5c:d8:00:30:1d:00:a3:d1:08:00
SRC=218.79.115.169 DST=xxx.xxx.xxx.xxx LEN=48 TOS=0x00 PREC=0x00 TTL=114 ID=17374 DF
PROTO=TCP SPT=3513 DPT=8089 WINDOW=64800 RES=0x00 SYN URGP=0
-----------------------------------------------------------------
 
Old 04-09-2004, 01:12 AM   #2
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
It looks like someone's scanning for an open proxy. As long as your proxy doesn't allow connections from the outside to another outside address, you're OK. You can't stop port scans, all you can do is drop the packets (which you're already doing).
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Mail server port-scanning my firewall? bleunuit Linux - Networking 2 11-24-2004 05:14 PM
scanning Fulminedio Linux - Hardware 1 08-11-2004 10:54 AM
scanning for virus before saving in a linux server spyghost Linux - Networking 3 08-04-2004 02:03 AM
Mail server - Content Scanning - Antivirus Solution?? Dr Solomon Linux - Networking 3 02-12-2002 11:29 AM
Mail server - Content Scanning - Antivirus Solution?? Dr Solomon Linux - General 1 02-10-2002 12:42 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:51 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration