On Mon, 2004-03-29 at 11:00, Jason Corcoran wrote:
> Port 135 is open on the smoothwall box by default, is it normal to get
> several (prob. about 2-300 a day) attempted connections on this port?
> I have one server sitting in the DMZ should I have this port forwarded
> to a service on that machine or is there a service running by default on
> the smoothwall box?
Rule one: shut doors that you do not need open, i.e. that which is not
explicitly allowed is by default denied.
epmap Port 135 probes have been going around for the last few months some
virus I suppose.
It is number three in the list of stuff being logged here:
If you can spend time reading your logs you will find all sorts of stuff
happening, log all you want and read all you log.
If you want a little fun take one of these ips that are trying to attach
to your network and grep the logs for other connections from them.
If you are running your own single machine (on a network with other
people on it you could have legal problems doing this).
$ tcpdump -l -i XXX | tee logg
Where XXX is your internet connection ppp0 for dialup or eth0 or
whatever device connects your machine to the Internet.
You will be surprised at what you see.
It is not that bad at the moment, however when the next worm hits the
net it will shoot until it is supressed.
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!