LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 12-22-2006, 12:22 PM   #1
>>BLACKHOLE<<
Member
 
Registered: Jun 2006
Location: In the bended light of the prism-
Distribution: Mandriva
Posts: 53

Rep: Reputation: 15
port scanning attack!


hello everyone-
--------------

Someone has probed my port recently, My firewall says it's service 1043. The offending address is 192.168.1.1 Is there away to tell where that probe originated from?

How is it that they are able to see my box, when my firewall is up?
______________________________________________________

I'm trying to get this nix box working correctly as a server, so I can host my own blog and website. It's wireless and I need to know how to secure it. This is like the second time someone probed it, and I think it's the same person or persons!
______________________________________________________
Any suggestion would be appreciated
-------------------------------------

______________________________________________________
>>BLACKHOLE<< | +no knowledge or information can escape my dense gravitational pull<<



~in order to reach the glory of enlightment
_________________________________________
one must first tread the void of darkness~


>>BLACKHOLE<<

2006-(-_+)
 
Old 12-22-2006, 12:33 PM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985Reputation: 1985
probed your port? sounds like a euphamism that...

anyway, 192.168.1.1 is a private LAN address, most likely it's an ADSL router in someone's typical network configuration, so unless you've got your router doing really odd things, it's you. port 1043 is used by BOINC, the system that runs projects like seti@home and those other projects that use your spare cpu cycles...
 
Old 12-22-2006, 06:24 PM   #3
>>BLACKHOLE<<
Member
 
Registered: Jun 2006
Location: In the bended light of the prism-
Distribution: Mandriva
Posts: 53

Original Poster
Rep: Reputation: 15
hey whats up kpie-
-----------------

I'm real paranoid about this stuff, being that I'm new to this ya know? How can your own comp probe ports by itself???

I don't know what euphamism means, but it sounds funny.

LOL Hey Ima look that up!
_________________________________________________________________
>>BLACKHOLE<<

>>BLACKHOLE<<

2006-(-_+)
 
Old 12-23-2006, 10:09 AM   #4
masterofNanako
LQ Newbie
 
Registered: Dec 2006
Location: Northern Minnesota
Distribution: FedoraCore11 x86_64
Posts: 19

Rep: Reputation: 0
sounds to me like the address of an unconfigured router...
If you check your logs you may find this address reappearing quite frequently,
just watch the activity. IF you find it happening every few seconds or minutes and
every day etc. etc. etc.
it would be a 'NetWorksEverywhere' or D-link router for sure. Comes up all the time for me,
and was a real 'spammer' on my M$xp ZoneAlarm logs! ~8)
Just make sure Pam's nice an' comfy...
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Port scanning attack soulxcavtor Linux - Networking 2 06-02-2006 08:32 PM
Port scanning? muppski Linux - Security 6 07-01-2005 05:44 PM
port 80 attack, help!!!! davidtsui Linux - Security 7 01-12-2005 12:48 AM
port scanning johncla Linux - Networking 1 05-02-2001 03:09 AM
Port Scanning tfrye Linux - Security 2 03-24-2001 09:43 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:30 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration