Re: Port 109 scanning

[Fernando Cardoso <fernando () BN PT>]

Haven't seen those for a while. Those scans were popular in the beggining of
the year. Just checked my backlogs and found 3 SYN-FIN scans 109->109 back
in February, March and May. Two of them with origin in Japan and one from a
machine in the US. My class C was the target. Many isolated SYN scans to
port 109 occured since then. I'm not sure what they are looking, but I think
the older (=< 5.2?) RedHat distributions came with a POP2 daemon enable as
default.

Fernando


_________________________________________________________
Fernando Cardoso              Phone:   +351 21 7982186
Network Administrator         Fax:     +351 21 7982185
National Library              E-mail:  fernando () bn pt
Portugal                      PGP ID:  28551CB8


> -----Original Message-----
> From: A.L.Lambert [mailto:alambert () EPICREALM COM]
> Sent: segunda-feira, 6 de Novembro de 2000 13:26
> To: INCIDENTS () SECURITYFOCUS COM
> Subject: Port 109 scanning
>
>
>       I'm curious if anyone else has been getting port 109 SYN/FIN
> scan's lately? (src 109 -> dst 109).  I've gotten them from
> two separate
> sources, several days apart (looks like a sequential scan of multiple
> class A networks), and I thought it was a bit odd, since last time I
> heard, POP2 was a virtually abandoned protocol (at least I've
> never seen
> it in use, and I've been mucking around on the net for a long
> time now),
> and in this day and age, a SYN/FIN scan is almost certain to set off
> IDS's.
>
>       Normally a targeted scan looking for something that
> won't hurt my
> network wouldn't do much more than wake me up enough to
> e-mail the admin's
> of the offending network, but this one has my curiosity
> aroused, since on
> the surface, it looks both noisy, and pointless (or are there
> vulnerable
> pop2 servers all over the net that I'm unaware of?).
>
>       The source of the scan's were 204.31.162.252, and 209.84.237.75,
> and the targets were in the 200.x.x.x and 213.x.x.x netblock's.
>
>       Anyway, anyone with comments/thoughts, I'd be
> interested.  Thanks
> in advance.
>
>       --A.L.Lambert