Re: Where should I report port scans?

Article View: comp.protocols.tcp-ip

Article #15463

Back to comp.protocols.tcp-ip Previous Next

#15463

From: Lawrence Baldwin
Date: Sat, 14 Apr 2001 04:22

33 lines
3348 bytes

I'm working on syslog support...with Netgear being the priority.

Is the time stamp in local time or GMT?

I hope GMT, otherwise their lack of GMT offset info (e.g. -4:00 GMT) adds complexity for me.

Where is the timestamp obtained?  From the router clock? or is this what the syslogd adds?

Can the time/date format be changed...the one below doesn't even include the year.

lb.

In article <9b69qs$24sc$1@news.tht.net>, waltdnes@waltdnes.org says...
> Subject: Re: Where should I report port scans?
> From: waltdnes@waltdnes.org (Walter Dnes)
> Newsgroups: comp.protocols.tcp-ip, bellsouth.net.security, news.admin.net-abuse.email
> 
> 
> Apr 10 22:21:22 192.168.1.1 NetgearRT314: IP[Src=64.250.146.56 Dst=64.231.8.153 UDP spo=00137  dpo=00137]}S01>R02mD
> Apr 10 22:23:56 192.168.1.1 last message repeated 3 times
> Apr 10 22:23:59 192.168.1.1 last message repeated 2 times
> Apr 11 01:26:00 192.168.1.1 NetgearRT314: IP[Src=63.238.218.124 Dst=64.231.1.208 TCP spo=03379  dpo=00111]}S01>R01mD
> Apr 11 01:26:03 192.168.1.1 NetgearRT314: IP[Src=63.238.218.124 Dst=64.231.1.208 TCP spo=03379  dpo=00111]}S01>R01mD
> Apr 11 01:53:57 192.168.1.1 NetgearRT314: IP[Src=64.230.181.205 Dst=64.231.1.208 TCP spo=01944  dpo=00021]}S01>R01mD
> Apr 11 01:54:00 192.168.1.1 NetgearRT314: IP[Src=64.230.181.205 Dst=64.231.1.208 TCP spo=01944  dpo=00021]}S01>R01mD
> Apr 11 20:33:39 192.168.1.1 NetgearRT314: IP[Src=211.78.243.11 Dst=64.231.17.158 TCP spo=02343  dpo=00111]}S01>R01mD
> Apr 11 21:04:42 192.168.1.1 NetgearRT314: IP[Src=202.106.67.108 Dst=64.231.17.158 TCP spo=04401  dpo=00111]}S01>R01mD
> 

-- 
Lawrence Baldwin
Baseline your FastAccess Connection: http://www.mynetwatchman.com/perfwatch/beta.htm
Automatic Port Scan Reporting: http://www.mynetwatchman.com/vision.htm

Technical Details

Message-ID: <MPG.15419aacc57015d19896be@news2.mia.bellsouth.net>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.gv.tsc.tdk.com!news.iac.net!news-out.cwix.com!newsfeed.cwix.com!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news2.mia.POSTED!not-for-mail

References:

<3A9C3710.7F2E86F8@mynetwatchman.com> <96gk79.khf.ln@linux.abbitt.org> <wJOy6.3081$Rv.131064@news1.atl> <MPG.15369849667cdc0c989685@news2.mia.bellsouth.net> <xF6z6.315$U4.11027@burlma1-snr2> <MPG.153b74cbe7ab82a8989695@news2.mia.bellsouth.net> <9asm06$pvu$1@new-usenet.uk.sun.com> <B6F8472D.B0F7%nan-ae@nospam.nospam.porterfield.net.foo> <MPG.153d623dfe50249b9896a1@news2.mia.bellsouth.net> <9b69qs$24sc$1@news.tht.net>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10090f,64b87d735e5bf97e
X-Google-Attributes: gid10090f,public
X-Google-Thread: 104f05,64b87d735e5bf97e
X-Google-Attributes: gid104f05,public
X-Google-Thread: f9325,5fddf9b17d575149
X-Google-Attributes: gidf9325,public
X-Google-ArrivalTime: 2001-04-13 21:23:48 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.gv.tsc.tdk.com!news.iac.net!news-out.cwix.com!newsfeed.cwix.com!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news2.mia.POSTED!not-for-mail
From: Lawrence Baldwin <baldwinl@mynetwatchman.com>
Newsgroups: comp.protocols.tcp-ip,bellsouth.net.security,news.admin.net-abuse.email
Subject: Re: Where should I report port scans?
Message-ID: <MPG.15419aacc57015d19896be@news2.mia.bellsouth.net>
References: <3A9C3710.7F2E86F8@mynetwatchman.com> <96gk79.khf.ln@linux.abbitt.org> <wJOy6.3081$Rv.131064@news1.atl> <MPG.15369849667cdc0c989685@news2.mia.bellsouth.net> <xF6z6.315$U4.11027@burlma1-snr2> <MPG.153b74cbe7ab82a8989695@news2.mia.bellsouth.net> <9asm06$pvu$1@new-usenet.uk.sun.com> <B6F8472D.B0F7%nan-ae@nospam.nospam.porterfield.net.foo> <MPG.153d623dfe50249b9896a1@news2.mia.bellsouth.net> <9b69qs$24sc$1@news.tht.net>
Organization: System Management Technologies, Inc.
X-Newsreader: MicroPlanet Gravity v2.50
Lines: 33
Date: Sat, 14 Apr 2001 00:22:55 -0400
NNTP-Posting-Host: 209.214.36.180
X-Trace: news2.mia 987222175 209.214.36.180 (Sat, 14 Apr 2001 00:22:55 EDT)
NNTP-Posting-Date: Sat, 14 Apr 2001 00:22:55 EDT

Reply to Parent Message