[unisog] Scan of port 901/tcp

Anderson Johnston andy at umbc.edu
Mon Mar 10 17:48:55 GMT 2003


That puts it about an hour and a half ahead of us.  I notice that you guys
are 128.200.0.0/16 and we are 130.85.0.0/16.  Perhaps that 90 minutes have
been scans of 128.201.0.0/16 through 130.84.0.0/16.  If so, someone's
being quite thorough.

I've never used SWAT.  From the description on:

	http://samba.linuxbe.org/en/samba/learn/swat.html

it looks like something which is easy to configure badly,
authentication-wise.  Perhaps someone is rattling all the doorknobs on the
street.
					Thanks,
						- Andy

On Mon, 10 Mar 2003, Mike Iglesias wrote:

> We saw a scan of port 901 from the same source IP address as you did
> around 3am our time (US Pacific).
>
>
> Mike Iglesias                          Internet:    iglesias at draco.acs.uci.edu
> University of California, Irvine       phone:       949-824-6926
> Network & Academic Computing Services  FAX:         949-824-2069
>

------------------------------------------------------------------------------
** Andy Johnston (andy at umbc.edu)          *            pager: 410-678-8949  **
** Manager of IT Security                 * PGP key:(afj2002) 4096/8448B056 **
** Office of Information Technology, UMBC *   4A B4 96 64 D9 B6 EF E3 21 9A **
** 410-455-2583 (v)/410-455-1065 (f)      *   46 1A 37 11 F5 6C 84 48 B0 56 **
------------------------------------------------------------------------------




More information about the unisog mailing list