[Snort-users] port scan question
tony cowling
tonycowling at ...3945...
Mon Feb 14 20:46:08 EST 2005
Is there a normal level of port scan traffic on a network?
This is an example I have with 192.168.0.0 255.255.255.0 home network
And 192.168.1.0 255.255.255.0 being a connected network via vpn.
Should I be concerned?
[**] (portscan) TCP Portsweep [**]
02/14-15:25:50.360513 192.168.1.82 -> 192.168.0.12
PROTO255 TTL:0 TOS:0x0 ID:49200 IpLen:20 DgmLen:173
50 72 69 6F 72 69 74 79 20 43 6F 75 6E 74 3A 20 Priority Count:
35 0A 43 6F 6E 6E 65 63 74 69 6F 6E 20 43 6F 75 5.Connection Cou
6E 74 3A 20 32 0A 49 50 20 43 6F 75 6E 74 3A 20 nt: 2.IP Count:
35 0A 53 63 61 6E 6E 65 64 20 49 50 20 52 61 6E 5.Scanned IP Ran
67 65 3A 20 31 39 32 2E 31 36 38 2E 30 2E 35 3A ge: 192.168.0.5:
31 39 32 2E 31 36 38 2E 30 2E 31 32 0A 50 6F 72 192.168.0.12.Por
74 2F 50 72 6F 74 6F 20 43 6F 75 6E 74 3A 20 36 t/Proto Count: 6
0A 50 6F 72 74 2F 50 72 6F 74 6F 20 52 61 6E 67 .Port/Proto Rang
65 3A 20 38 30 3A 31 30 32 36 0A e: 80:1026.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050214/be9ea508/attachment.html>
More information about the Snort-users
mailing list