Re: Where should I report port scans?

Article View: comp.protocols.tcp-ip

Article #15468

Back to comp.protocols.tcp-ip Previous Next

#15468

From: Ray Abbitt
Date: Thu, 01 Mar 2001 03:37

17 lines
2059 bytes

In article <3A9D3A6B.F5CC6176@mynetwatchman.com>,
Lawrence Baldwin  <baldwinlSPAMMENOT@mynetwatchman.com> wrote:
>
>Our false-positive rate is remarkably low...in the last 30 days we have
>only had ONE incident where the source provider indicated that the
>attack was really their load-balancing servers sending DNS queries to
>determine RTT and best route.
>
One question on that. Do you really consider sending repeated DNS queries
to systems that are not listed as DNS servers (and in fact do not run
DNS servers) anything other than abusive? Maybe the load-balancing software
is broken, but once they know that, shouldn't something be done about it?
(And was Microsoft the guilty party? I'm still getting large numbers of
attempts [30000-40000 a month] on port 53 from various Microsoft addresses.)

-ray

Technical Details

Message-ID: <96gk79.khf.ln@linux.abbitt.org>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!logbridge.uoregon.edu!europa.netcrusader.net!208.184.7.66!newsfeed.skycache.com!Cidera!news.inreach.com!not-for-mail

References: <3A9C3710.7F2E86F8@mynetwatchman.com> <87zof7k7hx.fsf@cain.internet2.edu> <3A9D3A6B.F5CC6176@mynetwatchman.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10090f,64b87d735e5bf97e
X-Google-Attributes: gid10090f,public
X-Google-Thread: 104f05,64b87d735e5bf97e
X-Google-Attributes: gid104f05,public
X-Google-Thread: f9325,5fddf9b17d575149
X-Google-Attributes: gidf9325,public
X-Google-ArrivalTime: 2001-02-28 19:54:05 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!logbridge.uoregon.edu!europa.netcrusader.net!208.184.7.66!newsfeed.skycache.com!Cidera!news.inreach.com!not-for-mail
Newsgroups: comp.protocols.tcp-ip,bellsouth.net.security,news.admin.net-abuse.email
Subject: Re: Where should I report port scans?
References: <3A9C3710.7F2E86F8@mynetwatchman.com> <87zof7k7hx.fsf@cain.internet2.edu> <3A9D3A6B.F5CC6176@mynetwatchman.com>
From: Ray Abbitt <usenet-abuse@abbitt.org>
Reply-To: rabbitt+usenet@abbitt.org
X-Newsreader: trn 4.0-test74 (May 26, 2000)
Originator: rabbitt@linux.abbitt.org (Ray Abbitt)
Message-ID: <96gk79.khf.ln@linux.abbitt.org>
Lines: 18
Date: Wed, 28 Feb 2001 19:37:45 -0800
NNTP-Posting-Host: 209.142.39.173
X-Trace: news.inreach.com 983418374 209.142.39.173 (Wed, 28 Feb 2001 19:46:14 PST)
NNTP-Posting-Date: Wed, 28 Feb 2001 19:46:14 PST
Organization: InReach Internet

Reply to Parent Message