Cable Forum - View Single Post

Matth · 17-05-2004, 23:01

Candidates for reporting tend to be:
1. Repeated hits on the same port, from the same address
2. A spread of ports, from one address, particularly with a pattern of those ports

I've been using this firewall for so long, I have a gut feeling as to what is "hostile" probing, and what is just junk.

It may be better to send log reports to Dshield, as by collating reports, a clearer picture of the real troublemakers emerges.
http://www.dshield.org
It's also worth looking at the ports flagged there, as that shows what is rattling around.

The "noise level" is worse than usual...
Port 2745 has been getting quite a hammering
5000 is on the increase
5554 and 9898 are ones I haven't seen taking hit's before - there's GOT to be another couple of worm variants out there - that's what most of it is these days, worms trying to find holes.

NTL need to intensify their quarantine policy, and SOONER rather than later - they shut the door after the horse had bolted, when it came to Blaster, but at least the port blocking an quarantine stopped re-infection.

Mind you, most of the current ports are dynamic, and blocking those could interfere with normal traffic.

All it needs, is a few trap systems in the address range, hit two of them in close succession and you're in trouble.

17-05-2004, 23:01	#4
Matth Inactive Join Date: Mar 2004 Services: BB:M, TV:XL, Phone:M, Loyalty Posts: 2,516	Re: Firewall logs Candidates for reporting tend to be: 1. Repeated hits on the same port, from the same address 2. A spread of ports, from one address, particularly with a pattern of those ports I've been using this firewall for so long, I have a gut feeling as to what is "hostile" probing, and what is just junk. It may be better to send log reports to Dshield, as by collating reports, a clearer picture of the real troublemakers emerges. http://www.dshield.org It's also worth looking at the ports flagged there, as that shows what is rattling around. The "noise level" is worse than usual... Port 2745 has been getting quite a hammering 5000 is on the increase 5554 and 9898 are ones I haven't seen taking hit's before - there's GOT to be another couple of worm variants out there - that's what most of it is these days, worms trying to find holes. NTL need to intensify their quarantine policy, and SOONER rather than later - they shut the door after the horse had bolted, when it came to Blaster, but at least the port blocking an quarantine stopped re-infection. Mind you, most of the current ports are dynamic, and blocking those could interfere with normal traffic. All it needs, is a few trap systems in the address range, hit two of them in close succession and you're in trouble.