[Snort-users] port 22 scan

Wirth, Jeff WirthJe at ...4876...
Tue Jun 4 09:58:04 EDT 2002

From: Gongya Yu [mailto:yu at ...6004...]
> Hi, all:
>       I keep getting port 22 scanning across the whole subnets. The
> source port is also 22.  The source ips are (HK),
> (KR) and (MY).

Welcome to the club! Not a day goes by that we don't see something
originating from HK/KR.  And reflexive scans (same src and dst port) for ssh
is extremely popular. 

>       Any tools outside can be used to specify the source port when
> doing scanning ?

hping, among others...

>       Anyone has got the same scanning ?

just this morning. ;-) same stimulus, different HK/KR IP.


- Jeff

More information about the Snort-users mailing list