[ILUG] port scanning.. continued.

[Donncha O Caoimh]

To further add fuel to the fire.. here's some more interesting stuff:
Mar 12 03:28:47 mail portsentry[7764]: attackalert: Unknown Type: Packet
Flags: SYN: 1 FIN: 1 ACK: 0 PSH: 0 URG: 0 RST: 0 from host:
samantha.craghe
ad.com/216.15.159.194 to TCP port: 109
Mar 12 03:28:47 mail portsentry[7764]: attackalert: Host 216.15.159.194
has been blocked via wrappers with string: "ALL: 216.15.159.194"
Mar 12 03:28:47 mail portsentry[7764]: attackalert: Host 216.15.159.194
has been blocked via dropped route using command: "/sbin/ipfwadm -I -i
deny 
-S 216.15.159.194 -o"
Mar 12 03:28:48 mail portsentry[7764]: attackalert: Unknown Type: Packet
Flags: SYN: 1 FIN: 1 ACK: 0 PSH: 0 URG: 0 RST: 0 from host:
samantha.craghe
ad.com/216.15.159.194 to TCP port: 109
Mar 12 03:28:48 mail portsentry[7764]: attackalert: Host:
samantha.craghead.com/216.15.159.194 is already blocked Ignoring
Mar 12 03:28:48 mail portsentry[7764]: attackalert: Unknown Type: Packet
Flags: SYN: 1 FIN: 1 ACK: 0 PSH: 0 URG: 0 RST: 0 from host:
samantha.craghe
ad.com/216.15.159.194 to TCP port: 109
Mar 12 03:28:48 mail portsentry[7764]: attackalert: Host:
samantha.craghead.com/216.15.159.194 is already blocked Ignoring
Mar 12 03:28:48 mail portsentry[7764]: attackalert: Unknown Type: Packet
Flags: SYN: 1 FIN: 1 ACK: 0 PSH: 0 URG: 0 RST: 0 from host:
samantha.craghe
ad.com/216.15.159.194 to TCP port: 109
Mar 12 03:28:48 mail portsentry[7764]: attackalert: Host:
samantha.craghead.com/216.15.159.194 is already blocked Ignoring
Mar 12 03:28:48 mail portsentry[7764]: attackalert: Unknown Type: Packet
Flags: SYN: 1 FIN: 1 ACK: 0 PSH: 0 URG: 0 RST: 0 from host:
samantha.craghe
ad.com/216.15.159.194 to TCP port: 109
Mar 12 03:28:48 mail portsentry[7764]: attackalert: Host:
samantha.craghead.com/216.15.159.194 is already blocked Ignoring

and a few minutes later, from an internal box running RH 6.1:
Mar 12 03:52:30 mail kernel: Warning: possible SYN flood from
192.168.1.7 on 192.168.1.1:823.  Sending cookies.
which was the last message until syslog was restarted 30 minutes later
via crontab/logrotate. (suspicious?)

hmm.. from /etc/services, port 109 is 
pop-2       109/tcp     postoffice  # POP version 2


Donncha.

Sascha Lucky Luck wrote:
> 
> Thus spoke Dave Airlie:
> > you sure about that? a web-server initating a connection wou,d not use
> > port 80,,  IMHO .. it would have done an accept and listen or other way
> > around on port 80 waiting for new connects, why would it start one from
> > it?
> 
> It's a 'back' connection - it should have been originated from Donncha's
> box.