Port scan from Apache?

Lupe Christoph lupe at lupe-christoph.de
Tue Jul 18 17:31:53 UTC 2006


On Tuesday, 2006-07-18 at 18:11:50 +0200, Clemens Renner wrote:

> [Root]system-alert-00016: Port scan! From $my-server-ip:80 to 
> $their-server-ip:8254, proto TCP (zone Untrust, int ethernet1). Occurred 
> 1 times.

With IPFilter, I often see "dangling FINs" in the log. These occur when
the TCP connection has been shut down but an additional FIN is still
travelling. IPFilter will have abandoned the state for the connection,
so for it these FIN are not associated to a connection.

Since the message they gave you is of the "Danger, Will Robinson" kind,
this could be the case. They can't prove it wrong.

To me, this is a case of stupid until proven intelligent.

HTH,
Lupe Christoph

PS: I thought a port scan means somebody is probing many ports. How can
    one packet be considered a port scan?!?
-- 
| You know we're sitting on four million pounds of fuel, one nuclear     |
| weapon and a thing that has 270,000 moving parts built by the lowest   |
| bidder. Makes you feel good, doesn't it?                               |
| Rockhound in "Armageddon", 1998, about the Space Shuttle               |


More information about the freebsd-security mailing list