portscan

["Petriz, Pablo" <ppetriz () siscat com ar>]

Hello list!
My Snort 1.8.6 (RH 7.2)is monitoring a DMZ between 2 private networks.
At DMZ we have Apache + SCO Tarantella and a MS Terminal Server 
to share an application. I have various connections working well
and today we were bringing up a new connection when Snort detects
a portscan from the PC (Win98) we were working. The bring up job 
consists on pointing the browser to the site at the DMZ and then login
to Tarantella, so what can be the cause of the portscan from that PC?
portscan.log shows entries to port 80 (apache)and 3144 (tarantella)
Here are the alert and portscan.log files. 
Thank you!!!

PABLO

alert
=====
[**] [100:1:1]  <eth1> spp_portscan: PORTSCAN DETECTED on eth1 to port 80
from x.x.x.x (STEALTH) [**]
05/30-13:21:40.010817 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 2
connections across 1 hosts: TCP(2), UDP(0) STEALTH [**]
05/30-13:22:41.428323 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:22:47.311326 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 2
connections across 1 hosts: TCP(2), UDP(0) STEALTH [**]
05/30-13:25:19.802265 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 2
connections across 1 hosts: TCP(2), UDP(0) [**]
05/30-13:29:04.070375 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:30:36.666846 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:30:40.024516 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 2
connections across 1 hosts: TCP(2), UDP(0) STEALTH [**]
05/30-13:30:44.383457 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:34:34.340470 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:35:06.263163 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:35:16.842867 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:35:35.662691 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 2
connections across 1 hosts: TCP(2), UDP(0) STEALTH [**]
05/30-13:37:11.728234 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:37:58.647353 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 2
connections across 1 hosts: TCP(2), UDP(0) [**]
05/30-13:38:10.834317 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:39:09.880222 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:39:31.116911 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:39:51.451081 
[**] [100:2:1]  <eth1> spp_portscan: portscan status from x.x.x.x: 1
connections across 1 hosts: TCP(1), UDP(0) [**]
05/30-13:44:02.704023 
[**] [100:3:1]  <eth1> spp_portscan: End of portscan from x.x.x.x: TOTAL
time(1093s) hosts(1) TCP(24) UDP(0) STEALTH [**]
05/30-13:44:07.835669 

portscan.log
============
May 30 13:22:41 x.x.x.x:1099 -> y.y.y.y:80 SYN ******S* 
May 30 13:21:39 x.x.x.x:1097 -> y.y.y.y:80 VECNA 1***P**F 
May 30 13:22:47 x.x.x.x:1100 -> y.y.y.y:3144 SYN ******S* 
May 30 13:25:19 x.x.x.x:1102 -> y.y.y.y:80 SYN ******S* 
May 30 13:22:49 x.x.x.x:1101 -> y.y.y.y:80 NOACK *****RSF 
May 30 13:25:20 x.x.x.x:1103 -> y.y.y.y:3144 SYN ******S* 
May 30 13:29:04 x.x.x.x:1104 -> y.y.y.y:80 SYN ******S* 
May 30 13:30:36 x.x.x.x:1106 -> y.y.y.y:80 SYN ******S* 
May 30 13:30:40 x.x.x.x:1107 -> y.y.y.y:80 SYN ******S* 
May 30 13:30:44 x.x.x.x:1106 -> y.y.y.y:80 NOACK ****P*S* 
May 30 13:30:43 x.x.x.x:1107 -> y.y.y.y:80 VECNA 12U***** 
May 30 13:34:34 x.x.x.x:1112 -> y.y.y.y:80 SYN ******S* 
May 30 13:35:06 x.x.x.x:1115 -> y.y.y.y:80 SYN ******S* 
May 30 13:35:16 x.x.x.x:1116 -> y.y.y.y:80 SYN ******S* 
May 30 13:35:35 x.x.x.x:1118 -> y.y.y.y:3144 SYN ******S* 
May 30 13:35:36 x.x.x.x:1116 -> y.y.y.y:80 VECNA **U***** 
May 30 13:37:11 x.x.x.x:1121 -> y.y.y.y:80 SYN ******S* 
May 30 13:37:58 x.x.x.x:1125 -> y.y.y.y:80 SYN ******S* 
May 30 13:37:59 x.x.x.x:1126 -> y.y.y.y:80 SYN ******S* 
May 30 13:38:10 x.x.x.x:1128 -> y.y.y.y:3144 SYN ******S* 
May 30 13:39:09 x.x.x.x:1130 -> y.y.y.y:80 SYN ******S* 
May 30 13:39:31 x.x.x.x:1131 -> y.y.y.y:80 SYN ******S* 
May 30 13:39:51 x.x.x.x:1135 -> y.y.y.y:80 SYN ******S* 
May 30 13:39:52 x.x.x.x:1137 -> y.y.y.y:80 SYN ******S* 

_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users