R: correlation between porscans and local activity

[raist () CTRADE IT (Raistlin)]

> There now appears to be some coincidence between the times my family
> does web browsing and when I get scanned for port 1080.

Someone is probably trying to understand wether or not your is an open SOCKS
firewall they can use. I could bet these scans occur during IRC sessions
from one of your windows boxes (check if in the logs you have outgoing
traffic towards a 666X port).

Scanning IPs on IRC channels to check for open SOCKS it's a rather common
thing hackers-wanna-be love to do, since it leads to huge lists of addresses
they can trade, share and sell to other script kiddies around.

Just my bit of info,
Raist