[Snort-users] Getting 'portscanned' by IRC servers.
fernando at ...498...
Fri Sep 22 05:33:54 EDT 2000
You will find portscans not only to port 113 (ident) but also to 1080
(socks). This last one is to make sure you are not using some misconfigured
Wingate to mask your identity.
Fernando Cardoso Phone: +351 21 7982186
Network Administrator Fax: +351 21 7982185
National Library E-mail: fernando at ...498...
Portugal PGP ID: 28551CB8
> -----Original Message-----
> From: DmuZ [mailto:dmuz at ...496...]
> Sent: sexta-feira, 22 de Setembro de 2000 1:10
> To: snort-users at ...382...
> Subject: Re: [Snort-users] Getting 'portscanned' by IRC servers.
> I know for one IRC servers will attempt to connect to the
> IDENT port on a
> client while they log in. Are you sharing an IP with your
> roomate? How many
> ports are the servers attempting to connect to?
> dmuz at ...324...
> ~beware an angrypacket~
> ----- Original Message -----
> From: "Daniel Swan" <swan_daniel at ...479...>
> To: <snort-users at ...382...>
> Sent: Thursday, September 21, 2000 3:22 PM
> Subject: [Snort-users] Getting 'portscanned' by IRC servers.
> > My new roomate is an IRC'r, something I've never mucked
> with... now, I'm
> seeing all sorts of weird activity from IRC servers portscanning my
> computer. He has explained to me that this is normal
> behavior, as some IRC
> servers won't allow connexions from hosts with particular
> ports active.
> > My question is this: Can I ignore these IRC servers by
> adding them to
> $DNSSERVERS in snort-lib, and as well, is this such a good idea,
> consdidering they *are* IRC servers after all.
> > Thoughts?
> > --== Sent via Deja.com http://www.deja.com/ ==--
> > Before you buy.
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > http://lists.sourceforge.net/mailman/listinfo/snort-users
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
More information about the Snort-users