Date: Thu, 22 Feb 2001 13:39:00 -0800 From: Kris Kennaway <kris@obsecurity.org> To: Brent <brentb@loa.com> Cc: stable@freebsd.org Subject: Re: strange port activity Message-ID: <20010222133900.A7570@mollari.cthul.hu> In-Reply-To: <005a01c09d15$adb0e7e0$e32b82d0@cybertours.com>; from brentb@loa.com on Thu, Feb 22, 2001 at 04:23:19PM -0500 References: <005a01c09d15$adb0e7e0$e32b82d0@cybertours.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--vkogqOf2sHV7VnPd Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Thu, Feb 22, 2001 at 04:23:19PM -0500, Brent wrote: > i just cvsup my and did make world & kernel...--mergemaster...all is > good....so just to tighten things up a bit ..i installed portsentry from the > ports collection...installed without a prob...the FreeBSD box is on a very > large internel network ( its our LAN resourse machine) it runs a bunch of > company mailing lists ..as well as a web server among other things BUT I > DONT HAVE SAMBA installed....my question is this....i port scanned the > machine from another machine on the network...just to see what would > happen...and sure enough it mailed me...letting me know whats up.....THE > THING IS..it say its being scanned by 12 other machines on the network (i > know for fact it really isnt) ..ALL on port 161 what the heck runs on > port 161 ???? more /etc/services ... snmp 161/tcp snmp 161/udp ... I'm not sure why you mentioned SAMBA. I think you're being confused by portsentry telling you your machine is "being portscanned" when really it's just some routers or management nodes trying to connect to the SNMP service on your machine for management purposes. It's the same problem which causes people with Windows "personal firewall" software to go to red alert when they see a remote system returning an ICMP Unreachable packet at them, because the software is too trigger-happy and tells them they're being hacked. Kris --vkogqOf2sHV7VnPd Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE6lYb0Wry0BWjoQKURAqJ9AKD6ug4bEKDN4XrrKUwmP9s46qu/qQCfejzi vJ0M+yA8Sh61lWPzRUqn/aE= =QcOB -----END PGP SIGNATURE----- --vkogqOf2sHV7VnPd-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010222133900.A7570>