🚀 go-pugleaf

On Tue, 10 Apr 2001 14:47:33 GMT, Alun Jones <alun@texis.com> wrote:
>In article <B6F8472D.B0F7%nan-ae@nospam.nospam.porterfield.net.foo>, 
>DarkFiber <nan-ae@nospam.nospam.porterfield.net.foo> wrote:
>> Out of curiosity, what do people feel is a reportable margin for
>> protscans?
>
>Personally, if I find people apparently deliberately attempting
>connections to my machine, which is a non-public machine, behind a
>firewall and NAT, then I'm going to report them.  One SYN sent to the
>right port might be sufficient for me to make a report.  Only your ISP
>can tell you how many reports they'll find to be suspicious enough to
>warrant action.

I would agree. If the ISP (or block owner) only gets one report, then it
is a mistake probably. If they get many in the same time frame, then
something is wrong. I would doubt there is much gray area on this. This
should not be hard to tell. And I report almost all connection attempts
to non public ports. I run a mail server and web too, so I ignore that.
I ignore ICMP and 137 (because it is too time consuming to separate
legit from non-legit). The overwhelming number of attempts I see are to
well known vulnerable ports: 111, 515, 1080, 31337, 21, etc., though this
changes slowly over time. Anyone trying 111 is up to something IMO for
instance.

My intent is not so much to punish anyone, but to clean up some of this
stuff. I got two thank you notes yesterday from universities that I
reported port 111 attempts for instance.

-- 
Hal B
 hal@foobox.net
 hal@burgiss.net
 hburgiss@bellsouth.net
 Spamtrap: uce@ftc.gov and report@fraud.org
--