Re: scan log

[jason () WITTYS COM (Jason Witty)]

Max,

This looks an aweful lot like an valid FTP data connection to me (based on
the source port {20}).

Jason

At 10:30 PM 6/11/00 -0500, Max Gribov wrote:
> this are logs of a port scan i have recently recieved on one of my
> machines. i searched for those ports in all known port databases to me,
> but couldnt find anything. why would someone scan that specific range
> (observe the precise inrementation) of ports on a linux machine?
>
> Jun 11 22:20:21 mordor scanlogd: From 209.3.31.70:20 to 151.202.106.23
> ports 2632, 2633, 2634, 2635, 2636, 2637, 2638, 2639, 2640, ..., flags
> ??r??u, TOS 00, TTL 60, started at 22:20:13
>
>
> --
> Max Gribov
> System Administrator
>
> Knowledge Propulsion Laboratories
> www.kplab.com