1. Home
  2. Networking Firewalls
  3. Weird port scanning on my network

Weird port scanning on my network

I have a Watchguard Firebox that has been logging some interesting activity (to me at least). I am getting TONS of new traffic from pc's on my network that is going to incremental ports. It's tcp traffic sending SYN packets, so I'm assuming that its some sort of port scan, but not anything I have seen before or anything I can find help for. I have scanned the pc's with multiple antivirus software packages and have scanned them for Ad/Spyware with 2 packages. Here is a section of my log entry. Any help is appreciated. It may be nothing, but since this has started, my internet speed has also dropped.

Notice that the source port is incrementing by 1. these ports are always between 1000 and 4999. It hits port 80 as the destination port. Is this normal for browsing activity?

thanks

jf

-------------------------------------

510298 01/12/05 14:44:19 n allow out eth1 44 tcp 20 128 10.0.0.44 63.210.164.25 2199 80 syn (Filtered-HTTP) 510308 01/12/05 14:44:19 n allow out eth1 44 tcp 20 128 10.0.0.44 63.210.164.25 2200 80 syn (Filtered-HTTP) 510318 01/12/05 14:44:19 n allow out eth1 44 tcp 20 128 10.0.0.44 63.210.164.25 2201 80 syn (Filtered-HTTP) 510328 01/12/05 14:44:19 n allow out eth1 44 tcp 20 128 10.0.0.44 64.215.172.6 2202 80 syn (Filtered-HTTP) 510338 01/12/05 14:44:19 n allow out eth1 44 tcp 20 128 10.0.0.44 64.215.172.6 2203 80 syn (Filtered-HTTP) 510348 01/12/05 14:44:19 n allow out eth1 44 tcp 20 128 10.0.0.44 63.210.164.25 2204 80 syn (Filtered-HTTP) 510418 01/12/05 14:44:19 n allow out eth1 44 tcp 20 128 10.0.0.44 64.215.172.6 2205 80 syn (Filtered-HTTP) 510428 01/12/05 14:44:19 n allow out eth1 44 tcp 20 128 10.0.0.44 64.215.172.6 2206 80 syn (Filtered-HTTP) 510748 01/12/05 14:44:20 n allow out eth1 44 tcp 20 128 10.0.0.44 216.109.126.57 2208 80 syn (Filtered-HTTP)
Reply to
Jeff Franks
Loading thread data ...

I have also found the same on my corporate LAN. I have found on the net that it is something related to SQL. Check if your client is using some sort of SQL stuff. I would like to suggest u to download and install Microsoft Antispyware ad/malware removal tool. No doubt Microsoft has ever failed to address security issues but this tool works. I request u to forward me any solution, if u find 1, to me.

Thanx & Regards Jaydeep.

Jeff Franks wrote:

Ad/Spyware

internet

20
20
20
20
20
20
20
20
20
Reply to
jaydeep.kubavat

On Thu, 3 Feb 2005 12:59:34 -0600, Jeff Franks spoketh

Yes, the source port is (almost) always incremented by 1.

Lars M. Hansen

formatting link
'badnews' with 'news' in e-mail address)

Reply to
Lars M. Hansen

As for the small port range, that's a Windows peculiarity, and a leftover from the times when Bill Gates announced that everybody would be using Microsoft Network in the future, and no-one would even remember Internet... The small number of ports can be a problem in some circumstances, when the time it takes to cycle through the entire range is less than the maximum round-trip time, and also increases the chance of port guessing. Luckily, it's easily remedied (W2k and XP):

--- cut here --- save as foo.reg and double-click --- Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters] "MaxUserPort"=dword:00008000

--- cut here --- save as foo.reg and double-click ---

This will bump the highest port used for outgoing traffic up to 32768

Regards,

Reply to
Arthur Hagen

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.