Shockwave2 scans?

[James Lay <jlay () ameriben com>]

Umm..ok...just saw this about 5 minutes ago:

Feb  6 11:10:53 gateway kernel: Web1 drops:IN=br0 OUT=br0 PHYSIN=eth1
PHYSOUT=eth0 SRC=63.111.197.241 DST=10.1.18.1 LEN=48 TOS=0x00 PREC=0x00
TTL=114 ID=26974 DF PROTO=TCP SPT=62295 DPT=1257 WINDOW=65535 RES=0x00 SYN
URGP=0  
Feb  6 11:10:53 gateway kernel: Web drops:IN=br0 OUT=br0 PHYSIN=eth1
PHYSOUT=eth0 SRC=63.111.197.241 DST=10.1.19.1 LEN=48 TOS=0x00 PREC=0x00
TTL=114 ID=26975 DF PROTO=TCP SPT=62296 DPT=1257 WINDOW=65535 RES=0x00 SYN
URGP=0  
Feb  6 11:10:53 gateway kernel: Web drops:IN=br0 OUT=br0 PHYSIN=eth1
PHYSOUT=eth0 SRC=63.111.197.241 DST=10.1.19.2 LEN=48 TOS=0x00 PREC=0x00
TTL=114 ID=26976 DF PROTO=TCP SPT=62297 DPT=1257 WINDOW=65535 RES=0x00 SYN
URGP=0  
Feb  6 11:10:53 gateway kernel: Web drops:IN=br0 OUT=br0 PHYSIN=eth1
PHYSOUT=eth0 SRC=63.111.197.241 DST=10.1.19.4 LEN=48 TOS=0x00 PREC=0x00
TTL=114 ID=26977 DF PROTO=TCP SPT=62298 DPT=1257 WINDOW=65535 RES=0x00 SYN
URGP=0  
Feb  6 11:10:53 gateway kernel: Web drops:IN=br0 OUT=br0 PHYSIN=eth1
PHYSOUT=eth0 SRC=63.111.197.241 DST=10.1.19.7 LEN=48 TOS=0x00 PREC=0x00
TTL=116 ID=26979 DF PROTO=TCP SPT=62300 DPT=1257 WINDOW=65535 RES=0x00 SYN
URGP=0  
Feb  6 11:10:53 gateway snort: Portscan detected from 63.111.197.241
Talker(fixed: 0 sliding: 0) Scanner(fixed: 5 sliding: 5)

That's just a segment of the total scan...anyone else seeing this?

James Lay
Network Manager/Security Officer
AmeriBen Solutions/IEC Group
Semper Vigilans!!!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html