Security Incidents mailing list archives

Re: strange, strange stuff


From: Erik <erik () SUBLEVO COM>
Date: Tue, 27 Mar 2001 16:20:51 -0500

I just nmap'ed my machine several times(about 10) and didn't get any
error messages like that, so I doubt its a case of Harry meets Harry...

Hugo van der Kooij wrote:

On Mon, 26 Mar 2001, Max Gribov wrote:


I did my weekly sweep of my machine, which involves portscans, log
reviews, etc, and during nmap'ing i came across this:

four consequtive nmaps below:

--------------------------------
Starting nmap V. 2.54BETA7 ( www.insecure.org/nmap/ )
Strange read error from 127.0.0.1 (104): Operation now in progress
Strange read error from 127.0.0.1 (104): Operation now in progress
Strange read error from 127.0.0.1 (104): Operation now in progress
Interesting ports on localhost (127.0.0.1):
(The 65494 ports scanned but not shown below are in state: closed)
Port       State       Service
22/tcp     open        ssh
113/tcp    open        auth
1918/tcp   open        unknown
2643/tcp   open        unknown
4986/tcp   open        unknown
6000/tcp   open        X11


.....

Why would someone use nmap to a local machine. I guess `lsof` and `netstat
-na` would be more reliable.

You have a typical case where Harry meets Harry. You are seeing your own
port scan and a clear demonstration why nmap to a localhost is not the
best thing to do. (It is quite likely you caused a temporal distortion in
the time/space continum while doing so.)

Hugo.

--
Hugo van der Kooij; Oranje Nassaustraat 16; 3155 VJ  Maasland
hvdkooij () vanderkooij org             http://hvdkooij.xs4all.nl/
Alle email is gebonden aan de regels beschreven op mijn homepage.
All email send to me is bound to the rules described on my homepage.
        Don't meddle in the affairs of sysadmins,
        for they are subtle and quick to anger.


--
Erik
erik () sublevo com

---------------------------------------------------------------------
The information contained in this e-mail message is confidential,
intended only for the use of the individual or entity named above.  If
the reader of this e-mail is not the intended recipient, or the employee
or agent responsible to deliver it to the intended recipient, you are
hereby notified that any review, dissemination, distribution or copying
of this communication is strictly prohibited.  If you have received this
e-mail in error, please contact postmaster () sublevo com
---------------------------------------------------------------------


Current thread: