[unisog] Scan of port 901/tcp

Marc Jimenez mjimenez at net.tufts.edu
Mon Mar 10 19:12:36 GMT 2003


Hi Andrew,
	Just as a data point, we're 130.64.0.0/16 and we did not see any
port 901 activity between those times.

	-Marc

Marc Jimenez
Network Engineering
Tufts University

"Diplomacy" is saying "nice doggy" until you can find a big rock.
-Heinlein

On Mon, 10 Mar 2003, Anderson Johnston wrote:

> That puts it about an hour and a half ahead of us.  I notice that you guys
> are 128.200.0.0/16 and we are 130.85.0.0/16.  Perhaps that 90 minutes have
> been scans of 128.201.0.0/16 through 130.84.0.0/16.  If so, someone's
> being quite thorough.
>
> I've never used SWAT.  From the description on:
>
> 	http://samba.linuxbe.org/en/samba/learn/swat.html
>
> it looks like something which is easy to configure badly,
> authentication-wise.  Perhaps someone is rattling all the doorknobs on the
> street.
> 					Thanks,
> 						- Andy
>
> On Mon, 10 Mar 2003, Mike Iglesias wrote:
>
> > We saw a scan of port 901 from the same source IP address as you did
> > around 3am our time (US Pacific).
> >
> >
> > Mike Iglesias                          Internet:    iglesias at draco.acs.uci.edu
> > University of California, Irvine       phone:       949-824-6926
> > Network & Academic Computing Services  FAX:         949-824-2069
> >
>
> ------------------------------------------------------------------------------
> ** Andy Johnston (andy at umbc.edu)          *            pager: 410-678-8949  **
> ** Manager of IT Security                 * PGP key:(afj2002) 4096/8448B056 **
> ** Office of Information Technology, UMBC *   4A B4 96 64 D9 B6 EF E3 21 9A **
> ** 410-455-2583 (v)/410-455-1065 (f)      *   46 1A 37 11 F5 6C 84 48 B0 56 **
> ------------------------------------------------------------------------------
>
>
>



More information about the unisog mailing list