Firewall log - portscan???

[Verwijderd]

Wanneer ik het volgende in mn firewall log heb staan, betekent dit een portscan? en zo ja is het voldoende om de firewall log naar [e-mail] te sturen?


1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1391->localhost:2, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1392->localhost:3, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1393->localhost:4, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1394->localhost:5, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1395->localhost:6, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1396->localhost:7, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1397->localhost:8, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1398->localhost:9, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1399->localhost:10, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1400->localhost:11, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1401->localhost:12, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1402->localhost:13, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1403->localhost:14, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1404->localhost:15, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1405->localhost:16, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1406->localhost:17, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1407->localhost:18, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1408->localhost:20, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1409->localhost:21, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1410->localhost:22, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1411->localhost:23, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1412->localhost:24, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1413->localhost:25, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1414->localhost:26, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1415->localhost:27, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1416->localhost:28, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1417->localhost:29, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1418->localhost:30, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1419->localhost:31, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1420->localhost:32, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1421->localhost:33, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1422->localhost:34, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1423->localhost:35, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1424->localhost:36, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1425->localhost:37, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1426->localhost:38, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1427->localhost:39, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1428->localhost:40, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1429->localhost:41, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1430->localhost:42, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1431->localhost:43, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1432->localhost:44, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1433->localhost:45, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1434->localhost:46, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1435->localhost:47, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1436->localhost:48, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1437->localhost:49, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1438->localhost:50, Owner: no owner
1,[30/Jun/2002 17:34:06] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1439->localhost:51, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1393->localhost:4, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1401->localhost:12, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1405->localhost:16, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1408->localhost:20, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1397->localhost:8, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1416->localhost:28, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1424->localhost:36, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1420->localhost:32, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1412->localhost:24, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1436->localhost:48, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1428->localhost:40, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1440->localhost:52, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1432->localhost:44, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1448->localhost:60, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1452->localhost:64, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1444->localhost:56, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1456->localhost:68, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1460->localhost:72, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1468->localhost:80, Owner: no owner
1,[30/Jun/2002 17:34:08] Rule 'Packet to unopened port received': Blocked: In TCP, 212.58.170.32:1464->localhost:76, Owner: no owner

[SiHiDa]

Op zondag 30 juni 2002 18:18 schreef _samurai het volgende:
Wanneer ik het volgende in mn firewall log heb staan, betekent dit een portscan? en zo ja is het voldoende om de firewall log naar [e-mail] te sturen?
[..]

Het lijkt er wel op. Persoonlijk vind ik het onschuldig, zou er geen werk van maken.

[Attilla]

Het lijkt me wel een poort scan en dat kan je naar abuse sturen.

Helaas doen zij er meestal weinig aan.

[Verwijderd]

hmm nee ik zou er ook geen werk van maken ware het niet dat dit iptje me vaker loopt te scannen dan denk ik, ik ga mailen

[PcDealer]

Kun je dit poorten niet op invisible zetten?

[Verwijderd]

die staan op invisible, maar daarom kan je ze nog wel scannen denk ik

oh en quicknet zegt:

Multikabel beleid
Het is onmogelijk te zien of een poortscan onschuldig, kwaadaardig, of zelfs per ongeluk is uitgevoerd. Dit betekent dat Multikabel een poortscan niet perse als een illegale daad (of als contractbreuk) beschouwt. Echter, wanneer dezelfde gebruiker meerdere scans uitvoert en steeds verbinding zoekt naar ongebruikelijke poorten, krijgt deze een waarschuwing dat deze activiteiten genoteerd staan.

Dus dat betekent dat ik niet ga mailen
* maar samurai gaat nu gewoon dat ip blokken *