Crookfingerjake
@comcast.net
|  Why is my PC scanning ports?
Recently while using the wireless network on my campus, I got an e-mail from our network security admin. He told me that my laptop was scanning ports on the network and if it continued he would disable my access.
I've never installed a port scanner on my laptop and the most recent updates for Spybot S&D, Ad-Aware, and Bit Defender found nothing other than advertiser cookies on my system.
I'm running Windows Vista Home Premium from a completely stripped down Dell Inspiron E1705. I'm curious if there are any inherent windows processes that will do this, or any popular programs like winamp, itunes, etc that might do this.
Any help appreciated.
My current HiijackThis log:
|
|
yock
The Internet Is For Porn
Premium,MVM
join:2000-11-21
Fairfield, OH | The HJT log doesn't show anything troubling. I'd like to know what this admin thinks you were scanning, how he knows it was you, and how he was able to associate those scans with you and your e-mail address. |
|
docrice
join:2008-03-31
Fremont, CA
| reply to Crookfingerjake
Vista itself may send out some traffic (such as the occasional Teredo lookup to Microsoft's servers if you have IPv6 enabled in your stack), etc.. That said, even if you have those anti-(misc) apps on your machine, those rely on signatures. Lots of stuff out there that doesn't get picked up by these apps.
Sniff the traffic on your interface and see what happens.
Alternately, if your campus has an open network, it might be possible that while your machine is idling, someone spoofed your MAC address and is performing port scans "on your behalf," so to speak.
You could also use something more simple like TCPView to see which apps are opening and closing connections locally on your machine. |
|
nwrickert
Premium,MVM
join:2004-09-04
Geneva, IL | reply to Crookfingerjake
Vista seems to attempt to build a description of the network to which you are connected. If the campus IDS is set to a hair trigger, perhaps it detects that. |
|
Crookfingerjake
@comcast.net | reply to Crookfingerjake
Thanks for the responses, I'm going to look into TCPView. What programs do you all suggest to best monitor my PC's network activity? |
|
docrice
join:2008-03-31
Fremont, CA | Wireshark. Quite frankly one of the best free tools out there.
»www.wireshark.org/download.html |
|
tdumaine
join:2004-03-14
Federal Way, WA | reply to Crookfingerjake
My bet is in my network places its automatically looking for network shares and the admin is picking up on that.
Why they would have those ports open and not blocked at the router, i dunno |
|
