<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
I couldn't find the source for the previous scans, because that log
fills up and overwrites so quickly. I did see some new scans just a few
minutes ago. The source appears to be udp port 389 -- which from my
research is associated with ldap. I've attached an excel doc with the
firewall logs for that period. I'm rebuilding the servers anyway, just
as a precaution (they needed it anyway), but I just still want to know
what exactly happened. Thanks<br>
<div class="moz-signature">
<meta content="text/html;" http-equiv="Content-Type">
Chad Salamon
<br>
Library Systems Administrator
<br>
Stow-Monroe Falls Public Library
<br>
330-688-3295
<br>
<a class="moz-txt-link-abbreviated" href="mailto:csalamon@oplin.org">csalamon@oplin.org</a>
<br>
</div>
<br>
<br>
Chad Neeper wrote:
<blockquote cite="mids267a4fd.081@mail.nrg92.com" type="cite">
<pre wrap="">Chad,
If they are malicious scans, those are odd ports to be scanning for, even if it's scanning for trojans/worms. The NoBackO trojan listens on 1201 UDP (and 1200 UDP), but I can't find anything that listens on the other ports you mention. What were the originating port numbers? If they are all the same, it is possible that these are actually blocked _responses_ back to your workstation from the domain controllers. Outbound connections from your workstation would have been random in the 1024+ range. Does your firewall report flags? Late FIN packets can occasionally be blocked by personal firewalls.
Chad
---------------------
Chad Neeper
Senior Systems Engineer
Network Response Group
614-481-9400
-- Full LAN/WAN consulting services specialized in libraries and schools --
</pre>
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap=""><a class="moz-txt-link-abbreviated" href="mailto:chadsalamon@neo.rr.com">chadsalamon@neo.rr.com</a> 04/21/05 10:25AM >>>
</pre>
</blockquote>
</blockquote>
</blockquote>
<pre wrap=""><!---->I have Sygate firewall installed on my machine and I noticed this
morning that I was being port scanned from both domain controllers
(windows 2000) on our network. Both domain controllers initiated a port
scan almost simultaneously. They scanned UDP ports 1179, 1191, 1201,
and 1215. I've never seen traffic like this coming from the domain
controllers. Does this sound like something innocent -- or do we have a
problem? I will continue researching this, but any ideas or suggestions
would be greatly appreciated.
</pre>
</blockquote>
</body>
</html>