Re: Where should I report port scans?

Article View: comp.protocols.tcp-ip

Article #15466

Back to comp.protocols.tcp-ip Previous Next

#15466

From: stanislav shalunov
Date: Wed, 28 Feb 2001 19:40

29 lines
2222 bytes

Lawrence Baldwin <baldwinlSPAMMENOT@mynetwatchman.com> writes:

> Could not agree with you more...blind escalation of individual port scan
> events is NOT productive as there is no conclusive way to determine
> whether the activity is bogus or real attack.
[...]
> As you can see our Escalation Rate is somewhere around 10%...thus we
> are filtering 90%.
[...]
> Absolutely, but we're finding that 80-90% of the escalations we send the
> source system ARE compromised hosts!  See:
> http://www.mynetwatchman.com/mynetwatchman/hotclosed.asp

Lawrence,

I misinterpreted what your site is doing (I read the URL in your
signature and clicked several links).  I somehow got the impression
that one end-user complaint generates one or more email messages to
abuse@.

Now that you explained what you're doing, I applaud your efforts.

P.S.: It may make sense to clarify this in about.htm file that you
point people to, as I might be not the only one confused.

-- 
Stanislav Shalunov		http://www.internet2.edu/~shalunov/

I never let school stand in the way of my education.  -- Mark Twain

Technical Details

Message-ID: <877l2ak34v.fsf@cain.internet2.edu>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!freenix!fr.usenet-edu.net!usenet-edu.net!fu-berlin.de!uni-berlin.de!cain.internet2.EDU!not-for-mail

References: <3A9C3710.7F2E86F8@mynetwatchman.com> <87zof7k7hx.fsf@cain.internet2.edu> <3A9D3A6B.F5CC6176@mynetwatchman.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f9325,5fddf9b17d575149
X-Google-Attributes: gidf9325,public
X-Google-Thread: 10090f,64b87d735e5bf97e
X-Google-Attributes: gid10090f,public
X-Google-Thread: 104f05,64b87d735e5bf97e
X-Google-Attributes: gid104f05,public
X-Google-ArrivalTime: 2001-02-28 11:44:08 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!freenix!fr.usenet-edu.net!usenet-edu.net!fu-berlin.de!uni-berlin.de!cain.internet2.EDU!not-for-mail
From: stanislav shalunov <shalunov@internet2.edu>
Newsgroups: comp.protocols.tcp-ip,bellsouth.net.security,news.admin.net-abuse.email
Subject: Re: Where should I report port scans?
Date: 28 Feb 2001 14:40:16 -0500
Organization: Internet2
Lines: 29
Sender: shalunov@cain.internet2.edu
Message-ID: <877l2ak34v.fsf@cain.internet2.edu>
References: <3A9C3710.7F2E86F8@mynetwatchman.com> <87zof7k7hx.fsf@cain.internet2.edu> <3A9D3A6B.F5CC6176@mynetwatchman.com>
NNTP-Posting-Host: cain.internet2.edu (209.211.239.83)
X-Trace: fu-berlin.de 983389219 26413678 209.211.239.83 (16 [41748])
X-Newsreader: Gnus v5.7/Emacs 20.4

Reply to Parent Message