[Snort-users] port 22 scan

Wirth, Jeff WirthJe at ...4876...
Tue Jun 4 09:58:04 EDT 2002


From: Gongya Yu [mailto:yu at ...6004...]
> Hi, all:
>       I keep getting port 22 scanning across the whole subnets. The
> source port is also 22.  The source ips are 203.198.176.51 (HK),
> 211.239.122.12 (KR) and 202.185.203.66 (MY).

Welcome to the club! Not a day goes by that we don't see something
originating from HK/KR.  And reflexive scans (same src and dst port) for ssh
is extremely popular. 

>       Any tools outside can be used to specify the source port when
> doing scanning ?

hping, among others...

>       Anyone has got the same scanning ?
> 

just this morning. ;-) same stimulus, different HK/KR IP.

> 

- Jeff




More information about the Snort-users mailing list