Re: 1953 & 1808

[esj () CS FIU EDU (Eric S. Johnson)]

> I have been receiving very slow, widely spaced attempts to
> ports 1808 and 1953 on two different networks for the past
> week, ...
> The scans - 4 or 5 a day, separated by 5-6 hours, were
> initially from an IP calling itself 'office.portal.ru',

> 1808/tcp is listed as Oracle-VP2 but 1953 is unassigned.

> Has anyone received anything like this also, and any idea
> what they are hoping for?  Thanks for response!

I have seen something like this too recently, hitting our campus /16 network
office.portal.ru (195.16.97.35) is scanning about 1 host/minute.

2000.01.30/195.16.97.35 - office.portal.ru - 344 host addrs
                                           - 29 dst ports (random?)
                                           - 9 src ports (6660-6668)

2000.01.31/195.16.97.35 - office.portal.ru - 994 host addrs
                                           - 2 dst ports 1479/1624
                                           - 1 src port 6667

2000.02.01/195.16.97.35 - office.portal.ru - 1065 host addrs
                                           - 2 dst ports 1479/1624
                                           - 1 src port 6667

2000.02.02/195.16.97.35 - office.portal.ru - 473 host addrs
                                           - 2 dst ports 1479/1624
                                           - 1 src port 6667

Seems HP printers are responding to this probe.

E