Re: very strange scan patterns

[ejovi () EJOVI NET (Ejovi Nuwere)]

Most routers/firewalls will prevent spoofing of internal addresses coming
from an external interface. Since if seems to be coming from two or
three specific machines I wouldn't rule out the idea of those machines
having been comprised.

What do the probing machines have in common? Same os? Same switch?

e.

> It looks like a probe (perhaps using nmap with the -sS option
> to spoof the source address) - port 23 gets noticed sinced it's obviously
> wrappered.  Unless it is some sort of host "bouncing/reflecting" from the
> real attacker
> to hosts "ourdomain" back to hosts to magpie and kefti.
> Can anyone explain this apparent activity or know the signature for this
> attack?
> Thanks
> Joe