Security Incidents mailing list archives

Re: SNMP Scans

From: Chris Schuler <cschuler () MINDLEADERS COM>
Date: Tue, 13 Mar 2001 11:05:15 -0500

anyone else seeing port 111/rpc scans from this ip?
211.185.160.193
Ive seen at least two walks of my ip address space by this host.


Mar 13 09:45:08 211.185.160.193:4671 -> xxx.xxx.xxx.xxx:111 SYN ******S*
Mar 13 09:45:08 211.185.160.193:4670 -> xxx.xxx.xxx.xxx:111 SYN ******S*
Mar 13 09:45:08 211.185.160.193:4672 -> xxx.xxx.xxx.xxx:111 SYN ******S*
...

Current thread:

SNMP Scans Crist Clark (Mar 05)
- <Possible follow-ups>
- Re: SNMP Scans H Carvey (Mar 11)
  - Re: SNMP Scans Omar Herrera (Mar 12)
    - Re: SNMP Scans MadHat (Mar 13)
- Re: SNMP Scans Chris Schuler (Mar 13)
  - Re: SNMP Scans John Oliver (Mar 14)
  - Port 111 Scans (odd single IP# probes too) Bryan Andersen (Mar 14)
    - Re: Port 111 Scans (odd single IP# probes too) Scott Nursten (Mar 15)
    - Re: Port 111 Scans (odd single IP# probes too) Rob Kouwenberg (Mar 15)
  - Re: SNMP Scans John (Mar 14)
  - Re: SNMP Scans Eric Kimminau (Mar 14)
  - Re: SNMP Scans Golden_Eternity (Mar 15)