[Snort-users] Getting 'portscanned' by IRC servers.

DmuZ dmuz at ...496...
Thu Sep 21 20:10:25 EDT 2000


Hey..

I know for one IRC servers will attempt to connect to the IDENT port on a
client while they log in. Are you sharing an IP with your roomate? How many
ports are the servers attempting to connect to?


DmuZ

dmuz at ...324...

~beware an angrypacket~


----- Original Message -----
From: "Daniel Swan" <swan_daniel at ...479...>
To: <snort-users at ...382...>
Sent: Thursday, September 21, 2000 3:22 PM
Subject: [Snort-users] Getting 'portscanned' by IRC servers.


> My new roomate is an IRC'r, something I've never mucked with... now, I'm
seeing all sorts of weird activity from IRC servers portscanning my
computer.   He has explained to me that this is normal behavior, as some IRC
servers won't allow connexions from hosts with particular ports active.
>
> My question is this:  Can I ignore these IRC servers by adding them to
$DNSSERVERS in snort-lib, and as well, is this such a good idea,
consdidering they *are* IRC servers after all.
>
> Thoughts?
>
>
>
>
> --== Sent via Deja.com http://www.deja.com/ ==--
> Before you buy.
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> http://lists.sourceforge.net/mailman/listinfo/snort-users
>




More information about the Snort-users mailing list