[Dshield] Need some help...

Louis Hablas Louis.Hablas at rzim.org
Wed Aug 3 13:12:24 GMT 2005


Seeing a lot of entries like this lately:

2005-08-02	20:47:51	66.20.x.x	67.51.182.199	Udp
1822	137	-	BLOCKED	66.20.x.x
2005-08-02	20:47:53	66.20.x.x	67.51.182.199	Udp
1822	137	-	BLOCKED	66.20.x.x
2005-08-02	20:47:54	66.20.x.x	67.51.182.199	Udp
1822	137	-	BLOCKED	66.20.x.x

Obviously this is a little disconcerting and I'm baffled as to
what/where...

Fyi...I've got Trend ServerProtect running on all Servers/ Officescan on
all desktops plus, ports like 137 are blocked in/out...BUT (big BUT),
something bad (Opaserv/BugBear symptoms) appears to be trying to spread
from within.

Thoughts/suggestions? 

Also, prior to purchasing new laptop, I'd been using NMap (Win32
version) to keep tabs on ports open (on machines) within my firewall.  I
haven't installed network port scanner on new machine yet and would love
some suggestions.

Thanks,

Lou


Louis Hablas
Systems Manager
Ravi Zacharias International Ministries
http://www.rzim.org
770-810-4214



More information about the list mailing list