nanog mailing list archives
Re: Stopping ip range scans
From: johnl () iecc com (John R. Levine)
Date: 29 Dec 2003 17:42:32 -0000
My router is set up to send me daily reports of IP addresses that hit the port 137-139 block more than 1000 times a day. The sources are all over the place, including a lot of IANA reserved address space that Sprint and my ISP should be filtering upstream, but a lot of the scans are from hosts on my ISP's network that I know are consumer DSL. My working assumption is that these are worms looking for new hosts to attack. When I have time, I tell the ISP about the local ones so they can tell their customer to fix it, otherwise I don't bother. So long as you have reasonable router filters, port scans are an annoyance but not a security issue. -- John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 330 5711 johnl () iecc com, Village Trustee and Sewer Commissioner, http://iecc.com/johnl, Member, Provisional board, Coalition Against Unsolicited Commercial E-mail
Current thread:
- Stopping ip range scans william (Dec 29)
- Re: Stopping ip range scans Chris Brenton (Dec 29)
- Re: Stopping ip range scans william (Dec 29)
- Re: Stopping ip range scans John R. Levine (Dec 29)
- Re: Stopping ip range scans jlewis (Dec 29)
- Re: Stopping ip range scans Perry E. Metzger (Dec 29)
- Re: Stopping ip range scans Anton L. Kapela (Dec 29)
- Re: Stopping ip range scans Phil Rosenthal (Dec 29)
- <Possible follow-ups>
- RE: Stopping ip range scans william (Dec 29)
- Re: Stopping ip range scans haesu (Dec 29)