sslug-teknik team mailing list archive

Thread
Date

Stealth scan?

To: <sslug-teknik@xxxxxxxx>
From: Poul Anker Gensmann <gensmann@xxxxxx>
Date: Thu, 3 May 2001 10:43:28 +0200 (CEST)
Delivered-to: mailing list sslug-teknik@xxxxxxxx
Mailing-list: contact sslug-teknik-help@xxxxxxxx; run by ezmlm

Hej.

Følgende er fra min syslog:

----
May  3 10:37:12 gauss portsentry[401]: attackalert: Possible stealth
scan from unknown host to TCP port: 111 (accept failed)
May  3 10:37:29 gauss last message repeated 21021 times
May  3 10:37:29 gauss fetchmail[408]: 5.8.1 querying mail.pbk.dk
(protocol POP3) at Thu May  3 10:37:29 2001
May  3 10:37:29 gauss portsentry[401]: attackalert: Possible stealth
scan from unknown host to TCP port: 111 (accept failed)
May  3 10:37:47 gauss last message repeated 23031 times
----

Det resulterer i at portsentry bruger 70% af CPU tiden (fra top).

Der står det er fra 'unknown host'. Hvordan kan jeg finde ud af hvorfra
det sker?
Hvordan kan jeg evt. lukke port 111? - hvad laver RPC 4.0 portmapper ?

-- 
Venlig hilsen/Kind regards Poul Anker Gensmann
Contact info at http://pa.gensmann.dk