Quote:
|
Originally Posted by staffie
Hi - Newbie here with first post.
Over the last 2-3 weeks i have been port scanned on ports 2745, 3127 (TCP) 6129 (TCP) - not just the odd scans but 1000's of times. Over 400 yesterday alone. My macafee alerted me of these scans - and they are in green which means that they are on my LAN.
When i traced the scans back i get the following:-
2005/02/01 19:59:16 80.1.236.218:3837 (cpc1-bror2-3-0-cust218.brom.cable.ntl.com) 80.1.236.xxx :2745 URBISNET
Its the same for the other ports.
Could anyone please tell me why NTL are doing this? or is it a case of an infected pc on my LAN?
Although it seems that my firewall is doing its job, this is rather disconcerting and worrying as im relatively new to computers.
Any help or advice that anyone can provide would be most welcome.
thanks
staffie (alan)
|
Hi Alan
to Cable Forum
Firstly if your firewall is picking up the scans, you don't have to worry, as it is doing its job.
Secondly that URL looks like an NTL customer - interesting that you say it appears to be coming from your LAN, you would need to look at the IP of each PC on the LAN to see if it a local problem.
- however it is more likely to be a PC with a trojan, trying to recruit more unsuspecting victims.
as said earlier in the thread, you can send a copy of your firewall log to
abuse@ntlworld.com
- otherwise, using a router with NAT will screen out most port scans before they reach your McAffee firewall