Firewall Wizards mailing list archives
Re: Port scans to UDP 161 (SNMP)
From: Michael <mike () westphila net>
Date: Fri, 22 May 1998 10:37:59 -0400 (EDT)
On Thu, 21 May 1998, Max Euston wrote: [> Has anyone seen this before? I have been getting UDP (161/SNMP) port [>scans across my 205.247.224/24 (from .255 to .[012]?) repeatedly from [>certain IP #s. The most recent events happened 6 times over the past 5 [>days (all from the same IP). The user of that IP has a laptop w/ [>Win-95(B?) running FrontPage-98 and IE-4.01; they also have [>AOL-(something), Office-97, Outlook-98, Project-98. Although they use DHCP [>(in a Win-95/Win-NT shop), it seems that this machine has always gotten the [>same IP#. The user seems to have been using the machine during each scan. [> The UDP source port seems to stay in the range 1030-1035 (for this and [>previous scans from other locations). I don't have a dump of the incomming [>packets, just a log that they were dropped. I've seen this before, last year, from a couple of different sites. It seems that someone misconfigured some sort of monitoring software (their ip block was a couple numbers off from our address class). I vaguely rememeber talking to the admin in one of the cases, his reply is below. _M. From jledbetter () actware com Wed Oct 8 21:22:19 1997 Received: from act_server.actware.com (act.actware.com [208.130.99.4]) by lifted.rapiddata.com (8.8.5/8.8.5) with ESMTP id VAA25347; Wed, 8 Oct 1997 21:22:18 -0400 (EDT) Received: by act.ACTWARE.com with Internet Mail Service (5.0.1458.49) id <41SV5SSF>; Wed, 8 Oct 1997 21:21:24 -0400 Message-ID: <31BBCF704DFBD011AD5B006097585B47386B4A () act ACTWARE com> From: Jason Ledbetter <jledbetter () actware com> To: "'Michael'" <mike () lifted rapiddata com>, jledbetter () actware com, sburton () actware com Cc: "( Gurus )" <gurus () lifted rapiddata com> Subject: RE: Forwarded mail.... Date: Wed, 8 Oct 1997 21:21:23 -0400 X-Priority: 3 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1458.49) Content-Type: text/plain X-UID: 287 Status: RO X-Status: A Michael, I aplogize for taking so long to reply to your email. In short, we had some weird stuff going on here and I have firewalled outbound SNMP. I do aplogize for any inconvienes it may have caused. Jason Ledbetter Network Technical Specialist Applied Computer Technologies +- Michael_Jastremski_mike@westphila.net_http://westphila.net/mike -+ | | \____Digital_Photography_Experiment_http://images.westphila.net___/
Current thread:
- Port scans to UDP 161 (SNMP) Max Euston (May 21)
- Re: Port scans to UDP 161 (SNMP) M. Dodge Mumford (May 22)
- Log analysis tools Technical Incursion Countermeasures (May 22)
- Re: Port scans to UDP 161 (SNMP) Mookie (May 22)
- Re: Port scans to UDP 161 (SNMP) Michael (May 22)
- <Possible follow-ups>
- Re: Port scans to UDP 161 (SNMP) Steve Bellovin (May 22)
- Re: Port scans to UDP 161 (SNMP) H. Morrow Long (May 22)
- RE: Port scans to UDP 161 (SNMP) Max Euston (May 28)