republican-creole
Search:  

 
theme to white backgroundlet page decide theme
HomeFind ServiceReviewsISP NewsFAQsForumsToolsDatabaseAbout 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Up and Running » Security » Security » IPs From China
Uniqs:
411		 Share Topic:
RSS topic:
toggle:
flat / full
normal / watch
Posting:
Post a:
Post a:
Links: ·Hijack This logs? ·Panda Free Tools ·Vundo Removal
HJT Log »
« Silencing the Critics: IBIS  
c4delta

join:2001-02-08
Redmond, WA

IPs From China

I have been recieving a large number of attacks from China in the last few days--I see IP addresses from China in my firewall logs.

Is anybody else seeing something similar?
permalink · 2005-04-18 13:17:51 · Reply to this
max2k1
Hibernating In Texas

join:2001-06-01
Austin, TX

Re: IPs From China

Post a sample of source IPs and the destination & source port numbers ... maybe that'll get some matches !
permalink · 2005-04-18 13:49:21 · Reply to this
c4delta

join:2001-02-08
Redmond, WA

Re: IPs From China

HITS REMOTE LOCAL
13 61.172.244.159.34034 MYBOX.1026
14 61.172.244.159.32769 MYBOX.1026
24 61.172.244.159.32830 MYBOX.1026
permalink · 2005-04-18 14:31:26 · Reply to this

NetFixer
Freedom is NOT Free
Premium
join:2004-06-24
Murfreesboro, TN
·Vonage
·AT&T Southeast
·Cingular Wireless
·AT&T CallVantage

 Scans on the ephemeral ports beginning with 1025 are almost as common as scans of port 445. Unless you are really getting hammered (hundreds of scans per minute), it is just normal internet background noise and nothing to worry about since your firewall is blocking it.

My network typically receives hundreds of such scans daily, and thousands of port 445 scans. Many thanks to Bill Gates et al for exposing DCOM and SMB protocols to the world by default and making them such tempting targets for the evil dooers.
--
We can never have enough of nature.
We need to witness our own limits transgressed, and some life pasturing freely where we never wander.
permalink · 2005-04-18 15:07:52 · Print · Reply to this

exocet_cm
In memory of dadkins
Premium
join:2003-03-23
New Orleans, LA
clubs:
·Cox HSI
·Suddenlink
·Cingular Wireless
·AT&T Southeast
·Charter Pipeline

 I was fed up with Asian port scans and ended up blocking IPs from 222.0.0.0 - 222.255.255.255 (I think is the majority of allocated Asian IPs)...

I dunno if it is the OPTIMAL thing to do, but it works.
--
Jesus Rocks!
Future New Orleans Baptist student
Missionary work in Brasil is awesome!!!
permalink · 2005-04-18 16:08:03 · Reply to this
Forums » Up and Running » Security » SecurityHJT Log »
« Silencing the Critics: IBIS  

Tuesday, 01-Dec 05:16:30 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.republican-creole
page compression OFF
Most commented news this week
· [60] Baltimore To Ban Lazy Cable Installs
· [48] Broadband Killed The Game Console
· [36] Rural Carriers Quickly Embracing Fiber
· [31] AT&T Top Lobbyist Cicconi Has His Feelings Hurt
· [25] Charter Exits Chapter 11
· [22] Midcontinent Socked With Easement Lawsuit
· [4] Monday Evening Links
· [3] Monday Morning Links
Most people now reading
· 3.x Feral Druid - Bear Tanking Guide [World of Warcraft]
· Is Microsoft Technet ok to use for my family PC's? [Microsoft Help]
· Windows 7 boot manager editing questions [Microsoft Help]
· [Rant] called out sick! [Rants, Raves, and Praise]
· Connecting to Google Voice Via SIP [VOIP Tech Chat]
· [Newsgroups] Newzleech is either down or gone for good... [Filesharing Software]
· [Newsgroups] Newzleech down? [Filesharing Software]
· Considering Leaving Vonage, who should I Consider? [VOIP Tech Chat]
· Why is VoIP Better than POTS? [VOIP Tech Chat]
· [Snow Leopard] NFS Mounts - no more Directory Utility [All Things Macintosh]