Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
   Glossary   Glossary
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Author Topic: Port Scan Reported, a problem?  (Read 4752 times)

canon

  • Reg Member
  • ***
  • Posts: 171
Port Scan Reported, a problem?
« on: April 02, 2009, 04:31:33 PM »

Hi,
I have been getting regular security alerts from my Netgear router like the following:

Quote
TCP Packet - Source:61.139.105.163 Destination:My IP address - [PORT SCAN]
TCP Packet - Source:61.139.105.163 Destination:My IP address - [PORT SCAN

It is always the same source.

I did a whois lookup and get the following.
Quote
IP number is 61.139.105.163
This IP has no name and is probably from CN (CHINA)

IP whois lookup results:

[Querying whois.apnic.net]
[whois.apnic.net]
% [whois.apnic.net node-1]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:      61.139.105.128 - 61.139.105.191
netname:      ZIGONG-SCINFO-GOV
descr:        Zigong Sciences Informations Academe
descr:        ZiGong,Sichuan
descr:        PR China
country:      CN
admin-c:      XS16-AP
tech-c:       XS16-AP
mnt-by:       MAINT-CHINANET-SC
changed:      sxdong@mail.sc.cninfo.net 20010619
status:         ASSIGNED NON-PORTABLE
source:       APNIC
changed:      hm-changed@apnic.net  20020827

person:       Xiaodong Shi
nic-hdl:      XS16-AP
e-mail:       ipadmin@my-public.sc.cninfo.net
address:      No.72,Wen Miao Qian Str.
address:      Data Communication Bureau Of Sichuan Province
address:      Chengdu
address:      PR China
phone:        +86-28-6190785
fax-no:       +86-28-6190641
country:      CN
changed:      ipadmin@my-public.sc.cninfo.net 20030317
mnt-by:       MAINT-CHINANET-SC
source:       APNIC

Is this something I should worry about and is there anything I can do to stop it?
Thanks,
Terry.


Logged

jeffbb

  • Kitizen
  • ****
  • Posts: 2329
Re: Port Scan Reported, a problem?
« Reply #1 on: April 02, 2009, 06:59:02 PM »

Hi

This particular IP has been busy , Google has many reports on it . I do not think you can do anything . Your router firewall is protecting you . :)
Just reporting the attempts . One possible way to get rid of this if it is a bother is to reset PPOa session. That should give you another IP address ,unless you have a permanent one .But of course your new IP could be scanned . :(
Regards Jeff
Logged
zen user

mr_chris

  • Kitizen
  • ****
  • Posts: 3774
Re: Port Scan Reported, a problem?
« Reply #2 on: April 02, 2009, 07:15:23 PM »

As jeff says, your router is actually protecting you by reporting it.

Hosts get scanned all the time, it's an unfortunate byproduct of being connected to the Internet where opportunists will try to take advantage of any open system in order to try and spread viruses, spam, etc.

It's quite possible the host in question is compromised and the user of the PC is innocent (apart from not having adequate protection themselves, obviously)

Being behind a NAT router inherently keeps you safe, unless your router has any security holes, or you have any ports forwarded to computers on your network running services that have security holes...

It all just reinforces the need for a decent firewall (or NAT router) and good, up-to-date antivirus/anti-spyware software, and a bit of common sense!

Nothing to worry about though in your case, by the looks of it. If it continues to be a persistent problem, report the address to their ISP's abuse dept. Not sure how far it'll get you, given where it is though, but it's worth a shot if they carry on.
Logged
Chris

canon

  • Reg Member
  • ***
  • Posts: 171
Re: Port Scan Reported, a problem?
« Reply #3 on: April 02, 2009, 10:40:27 PM »

Thanks guys for your comments. I can relax now  :)
Terry.
Logged
 

anything