Prevent Port scaning
m.seaman at infracaninophile.co.uk
Tue Dec 30 13:27:49 PST 2003
On Tue, Dec 30, 2003 at 07:13:48PM +0300, Marwan Sultan wrote:
> Hello Subscribers..
> Happy new year for all,
> My /var/log/messages and /var/log/dmesg.today
> Is full of the following lines:
> Limiting open port RST response from 332 to 200 packets per second
> Limiting open port RST response from 212 to 200 packets per second
> Limiting open port RST response from 204 to 200 packets per second
> /kernel: Limiting open port RST response from 335 to 200 packets per second
> /kernel: Limiting open port RST response from 250 to 200 packets per second
> /kernel: Limiting open port RST response from 248 to 200 packets per second
> Which means someone scanning my ports. (correct me if im wrong)
That's a good working hypothesis. Someone is sending you a lot of
packets to port numbers where nothing is actually listening at such a
rate that your kernel is limiting the rate at which it will respond.
It could also be due to the MSBLASTER worm, which is still very
prevalent on the net: I see probes to port 135 on my machine about
every 30s. Which isn't fast enough to trigger the rate limiting
you're seeing, but if you were on a network with a lot of infected
machines isn't out of the question.
> My question is:
> How to prevent this? I asumed that I should put the IP in deny list.
Best thing to do is implement a firewall where you default to dropping
any incoming packet not to the set of specifically allowed services
you require. Note: you want to 'drop' or 'deny' the packet, rather
than 'reject' it. 'Drop' just chucks the packet in the bit-bucket and
nothing more. 'Reject' sends back an ICMP message saying "I can't
Another (much easier, but less secure) thing to so is use the
See blackhole(4) for details.
> But where is the IP?
Try running tcpdump(1) or ethereal(1) (ports: net/ethereal) to capture
> I cannot find any IP in my logs that it shows who is doing the scan.
> or trying to hack..or whatever,
Yes -- you will need to use the logging facilities of ipfw(8) or
ipf(8) to record that sort of thing. Or you might look at a NIDS like
snort (ports: security/snort , http://www.snort.org/)
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20031230/ddd87571/attachment.bin
More information about the freebsd-questions