[Snort-users] port 22 scan
WirthJe at ...4876...
Tue Jun 4 09:58:04 EDT 2002
From: Gongya Yu [mailto:yu at ...6004...]
> Hi, all:
> I keep getting port 22 scanning across the whole subnets. The
> source port is also 22. The source ips are 220.127.116.11 (HK),
> 18.104.22.168 (KR) and 22.214.171.124 (MY).
Welcome to the club! Not a day goes by that we don't see something
originating from HK/KR. And reflexive scans (same src and dst port) for ssh
is extremely popular.
> Any tools outside can be used to specify the source port when
> doing scanning ?
hping, among others...
> Anyone has got the same scanning ?
just this morning. ;-) same stimulus, different HK/KR IP.
More information about the Snort-users