KVR Audio

Barf · Post by **Barf** » Thu Dec 01, 2005 6:52 pm

For about two weeks now my firewall reports 'port scans' by the same IP, almost 10 times a day. Anyone know how to stop this?

vrdaudio · Post by **vrdaudio** » Thu Dec 01, 2005 7:05 pm

You might want to wait it out and hope it goes away.

Or, you could use a reverse-DNS lookup program and find out who their their ISP is and give them a heads up through email or phone.

bambooman · Post by **bambooman** » Thu Dec 01, 2005 7:48 pm

funny, i used to have the same problem!

i was able to solve this...
since this guy uses the same provider

my firewall reported:
"ip xyz, uses provider: XY, to scan port: YYY

i made a snapshot from this,
mailed it to my provider
and i found out,
it was a someone next door or so...
but no name/adress was given to me..
lucky him... i would...*#@+* out of this freak.

my provider then sent him a nice letter,
to stop these types of activities...
..otherwhise he might loose his flat-rate,
next time..

Muff Wiggler · Post by **Muff Wiggler** » Thu Dec 01, 2005 8:15 pm

sorry Barf, I'll stop now

cron · Post by **cron** » Thu Dec 01, 2005 8:22 pm

Chances are it's just some dude with a virus/worm on his machine. I get it all the time from a few people on my university's network.

Mr. Tunes · Post by **Mr. Tunes** » Thu Dec 01, 2005 8:49 pm

which firewall are you using that reports this activity? I used to use Norton until i deemed their program to be useless.

Barf · Post by **Barf** » Thu Dec 01, 2005 9:37 pm

Mr. Tunes wrote:which firewall are you using that reports this activity? I used to use Norton until i deemed their program to be useless.

I use Sygate, never had any problems with it. Maybe I should mail my provider about this.

John Vulich · Post by **John Vulich** » Thu Dec 01, 2005 9:45 pm

"Hello, Barf. I want to play a game."

Stupid American Pig · Post by **Stupid American Pig** » Thu Dec 01, 2005 9:47 pm

use a hardware firewall

robenestobenz · Post by **robenestobenz** » Fri Dec 02, 2005 2:57 am

I get constant scans and access attempts as well. I use Zonealarm free which is pretty good for a user-friendly basic firewall.

freeztar · Post by **freeztar** » Fri Dec 02, 2005 3:13 am

What ports are being scanned? Some are more vulnerable than others and a lot of them can be disabled for the average user.

Voidoid Surrealist · Post by **Voidoid Surrealist** » Fri Dec 02, 2005 3:14 am

Well, did he find a good one?

putte · Post by **putte** » Fri Dec 02, 2005 4:16 am

John Vulich wrote:

.. is this your latest work, john? man, you REALLY did better in the past ..

..

putte

robenestobenz · Post by **robenestobenz** » Fri Dec 02, 2005 8:43 am

freeztar wrote:What ports are being scanned? Some are more vulnerable than others and a lot of them can be disabled for the average user.

I'm getting too many to list.

Rune · Post by **Rune** » Fri Dec 02, 2005 8:58 am

If all the scanning attempts comes from the same IP, put the IP on the firewall's "all-block-list" or similar. You can try to localize the IP geographically here, but it won't be accurate: http://www.ripe.net/ You'll probably find the ISP's abuse mail address at least.

Some maniac scanning my ports