Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
   Glossary   Glossary
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Author Topic: Port Scan  (Read 3430 times)

canon

  • Reg Member
  • ***
  • Posts: 171
Port Scan
« on: June 04, 2007, 08:18:00 AM »

I had a DG834 report a Port Scan as Follows: -
TCP Packet - Source:219.148.119.2 Destination:xx.xxx.xxx.xxx - [PORT SCAN]
It appears to come from China.
Should I be worried?
Terry.
Logged

roseway

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 43598
  • Penguins CAN fly
    • DSLstats
Re: Port Scan
« Reply #1 on: June 04, 2007, 09:59:05 AM »

I wouldn't have thought so. By default the DG834 blocks all incoming access, so nobody is going to get in unless you invite them. You've probably just been on the receiving end of a random probe from somewhere.

Eric
Logged
  Eric

kitz

  • Administrator
  • Senior Kitizen
  • *
  • Posts: 33884
  • Trinity: Most guys do.
    • http://www.kitz.co.uk
Re: Port Scan
« Reply #2 on: June 04, 2007, 10:14:51 AM »

Its probably just some script kiddie somewhere who is scanning IP ranges to see if you have any open ports.

They usually scan for specific open ports, - most commonly those which are used by certain trojans, (or server ports). If you say for eg had a trojan on your system, then it would broadcast itself and the wannabe hacker would know that you have a weakness on your network which he could then attempt to exploit.

The fact that your router has picked this up is good and is just a notification to you.  Unfortunately this type of activity is rife on the internet and its something most of us get.
When I was with BT many years ago I found that I used to get on average at least a dozen port scans per day... sometimes a hell of a lot more.  For some reason they see the more common ISP ranges as being easy targets where more novice users are on-line.  Since being with PN, I still get them on occasions (although tbh I've now turned logging off).

You can complain to the ISP of source of the attempt - and whilst UK/US ISPs would look at this and likely issue their users with a warning/cut their connection....  the chinese and russian ISPs tend to be very lax and do nothing, which is why its a complete wast of time reporting it.. (and why I actually turned off my logging). :(

This sort of activity is a prime example of the background noise on the internet that increases bandwidth utilisation (eg your query the other day about why your bandwidth usage was xMB when your machines hadnt even been switched on).

Theres a bit more info here if you want to read
http://www.tamingthebeast.net/articles/scriptkiddies.htm

Logged
Please do not PM me with queries for broadband help as I may not be able to respond.
-----
How to get your router line stats :: ADSL Exchange Checker

canon

  • Reg Member
  • ***
  • Posts: 171
Re: Port Scan
« Reply #3 on: June 04, 2007, 10:30:09 AM »

Thanks for the comments.
I'd not seen a port scan reported before, anyway, it looks as though I can relax.
Terry.
Logged

soms

  • Reg Member
  • ***
  • Posts: 537
Re: Port Scan
« Reply #4 on: June 04, 2007, 11:25:01 AM »

Quote
I'd not seen a port scan reported before, anyway, it looks as though I can relax.
Terry.

Indeed, that is one of the nice things about NAT routers, a port scan only gets as far as the routers firewall, so unless you open up lots of ports your OK.

Interestingly, I set up what I believed to be a private dedicated game server and set up some port exceptions and then forgot to shut the server down. Unknown to me my server must have been appeared on the internet lists and when I came to shut down the server I noticed many users had connected to it and some had been playing games on it throughout the day!

Suffice to say I have left the port open for the private enjoyment of me and friends but have now created a configuration with a password and make sure I always shut down the server when I am not using it  ::)

Of course, some people I know also turn off all their equipment, including routers when not in use, so 1. it saves some power, and 2. no one can be using the bandwidth, attempting to get in etc.
Logged