[ILUG] AUTH requests on port 135.

[Paul O'Malley]

On Mon, 2004-03-29 at 11:00, Jason Corcoran wrote:

> Port 135 is open on the smoothwall box by default, is it normal to get 
> several (prob. about 2-300 a day) attempted connections on this port?
> I have one server sitting in the DMZ should I have this port forwarded 
> to a service on that machine or is there a service running by default on 
> the smoothwall box?

Rule one: shut doors that you do not need open, i.e. that which is not
explicitly allowed is by default denied.

epmap Port 135 probes have been going around for the last few months some 
virus I suppose.

It is number three in the list of stuff being logged here:

http://isc.sans.org/top10.html

If you can spend time reading your logs you will find all sorts of stuff
happening, log all you want and read all you log.
If you want a little fun take one of these ips that are trying to attach
to your network and grep the logs for other connections from them.

If you are running your own single machine (on a network with other
people on it you could have legal problems doing this).

as root 
$ tcpdump -l -i XXX | tee logg

Where XXX is your internet connection ppp0 for dialup or eth0 or
whatever device connects your machine to the Internet.

You will be surprised at what you see.

It is not that bad at the moment, however when the next worm hits the
net it will shoot until it is supressed.

Cheers,

Paul O'Malley