[ILUG] port scanning.. continued.

[Dave Airlie]

IMHO it sounds like you connect to their webserver, somehow close it they
transfer data to you which port sentry picks up, and you send back an ICMP
Dest Unreach which is 3 I think.

Dave.

On Tue, 14 Mar 2000, Donncha O Caoimh wrote:

> 3 times again this morning.. *grr* Can someone explain to me what the
> "ICMP/3" protocol/whatever is? 
> I'm wondering whether it's just port sentry being too sensitive or
> what..
> Otherwise I'm going to get onto their admin.
> 
> Donncha.
> 
> 
> Donncha O Caoimh wrote:
> > 
> > Now I'm sort of worried..
> > The dodgy network activity that occured around 9am yesterday morning
> > happened again after midday yesterday too, from the same host. Here's
> > what logcheck mailed me this morning:
> > Mar 13 12:47:13 mail kernel: IP fw-in deny eth0 TCP 216.15.159.194:80
> > <MY_IP>:64982 L=44 S=0x00 I=32299 F=0x0000 T=51
> > Mar 13 12:47:16 mail kernel: IP fw-in deny eth0 TCP 216.15.159.194:80
> > <MY_IP>:64982 L=44 S=0x00 I=32308 F=0x0000 T=51
> > Mar 13 12:47:22 mail kernel: IP fw-in deny eth0 TCP 216.15.159.194:80
> > <MY_IP>:64982 L=44 S=0x00 I=32362 F=0x0000 T=51
> > Mar 13 12:47:34 mail kernel: IP fw-in deny eth0 TCP 216.15.159.194:80
> > <MY_IP>:64982 L=44 S=0x00 I=32428 F=0x0000 T=51
> > Mar 13 12:47:37 mail kernel: IP fw-in deny eth0 ICMP/3 216.15.159.194
> > <MY_IP> L=68 S=0xC0 I=32438 F=0x0000 T=51
> 
> 

-- 
------------ David Airlie, David.Airlie at ul.ie,airlied at skynet --------
Telecommunications Research Centre, ECE Dept, University of Limerick \
http://www.csn.ul.ie/~airlied	-- Telecommunications Researcher      \
--- TEL: +353-61-202695 -----------------------------------------------