RE: Unusual port scan?

["Bojan Zdrnja" <Bojan.Zdrnja () LSS hr>]

> -----Original Message-----
> From: J Bailes [mailto:jonas2 () knology net] 
> Sent: Monday, 29 December 2003 11:59 a.m.
> To: incidents () securityfocus com
> Subject: Unusual port scan?
>
>
>
> My router logs on my personal/home machine just started 
> receiving with these scans:
>  
> 12/28/2003 13:05:44.133 - 81.52.250.105 : 80 >>> xx.xxx.xxx.xxx : 1800
> 12/28/2003 13:04:50.236 - 81.52.250.105 : 80 >>> xx.xxx.xxx.xxx : 1802

Do you have TCP flags in logs as well that you could post?

This looks to me like reply from normal Web service - maybe someone sent
spoofed SYN packets to Akamai boxes with your IP address set as the source
address.

There is no reason (AFAIK) for Akamai to scan you.

Cheers,

Bojan


---------------------------------------------------------------------------
----------------------------------------------------------------------------