Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #190158
| From | Glenn English <ghe2001@gmail.com> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | port scans (OT?) |
| Date | 2017-12-22 21:40 +0100 |
| Message-ID | <uZCgO-5VZ-3@gated-at.bofh.it> (permalink) |
| Organization | linux.* mail to news gateway |
Debian Squeeze (?) very old anyway, Dell server, Juniper SSG5 firewall. 1,000 miles away. I've started getting email from the firewall down there saying that it detected a port scan. Often enough of them to concern me -- several times a day. -- One just came in. Another 4 hours ago. From different IPs, from different (RIPE) countries. -- Is there any way to stop them? AFAIK, there isn't. I sure can't think of a way. The 'JuniperUsers list' says to talk to my upstream ISP. But I don't see how that would help if they can't do anything either (they also use Juniper). The firewall blocks them after it sees 10 hits from the same IP in 5000 microseconds. But by then Nmap (or eq) has hit 10 ports. Am I overly paranoid here? What if a non-script-kiddie is also doing this, but slowly enough that the firewall doesn't detect it? -- Glenn English
Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread
port scans (OT?) Glenn English <ghe2001@gmail.com> - 2017-12-22 21:40 +0100
Re: port scans (OT?) Dan Ritter <dsr@randomstring.org> - 2017-12-22 22:00 +0100
Re: port scans (OT?) Cindy-Sue Causey <butterflybytes@gmail.com> - 2017-12-22 22:00 +0100
Re: port scans (OT?) "Thomas Schmitt" <scdbackup@gmx.net> - 2017-12-22 22:10 +0100
Re: port scans (OT?) Richard Hector <richard@walnut.gen.nz> - 2017-12-23 00:20 +0100
Re: port scans (OT?) "Thomas Schmitt" <scdbackup@gmx.net> - 2017-12-23 08:40 +0100
Re: port scans (OT?) Glenn English <ghe2001@gmail.com> - 2017-12-23 01:40 +0100
Re: port scans (OT?) Brian <ad44@cityscape.co.uk> - 2017-12-23 00:00 +0100
csiph-web