port scan attacks? - Tilted Forum Project Discussion Community

nazz · 06-11-2003, 11:48 AM

Could you please shed any light on why my firewall would be reporting port scan attacks originating from catfish.tfproject.org?

Sty · 06-12-2003, 04:04 AM

please c&p a part of your firewall log showing this behavior.

nazz · 06-13-2003, 10:18 PM

I'm sorry that I don't have all the info saved. It was Helsinki 193.64.21.130 and catfish.tfproject.org but that's all of the info I have.

Next time I'll C&P it for you.

Thanks.

nazz · 06-17-2003, 02:12 PM

6 2 1 12.123.5.78 Chicago gbr2-p100.cgcil.ip.att.net
7 2 1 12.122.11.37 Chicago tbr1-p013602.cgcil.ip.att.net
8 2 1 12.123.6.33 Chicago ggr2-p300.cgcil.ip.att.net
9 3 2 209.0.227.77 Chicago so-1-1-0.edge1.chicago1.level3.net
10 4 2 209.244.8.9 Chicago so-2-1-0.bbr1.chicago1.level3.net
11 5 2 64.159.0.230 WASHINGTON D.C. so-0-1-0.bbr2.washington1.level3.net
12 6 2 212.187.128.133 Southwark so-0-0-0.mp2.london2.level3.net
13 7 2 212.187.128.225 Unknown so-4-1-0.mpls2.stockholm1.level3.net
14 8 2 213.242.68.52 Unknown gige5-1.hsipaccess2.stockholm1.level3.net
15 9 - 213.242.69.10 Unknown
16 10 3 213.192.191.129 Unknown so7-0-0-0.br1.esp1.fi.eunetip.net
17 10 3 213.192.191.45 Unknown ge2-3-0-0.br2.esp1.fi.eunetip.net
18 10 3 213.192.191.78 Unknown ge0-1-0-0.r1.alto.esp.fi.eunetip.net
19 11 3 212.226.252.82 Unknown gi2-0.r6.alto.esp.fi.eunetip.net
20 12 4 193.64.21.130 HELSINKI catfish.tfproject.org

Packet Data
Node High Low Avg Tot Lost
1 0 0 0 1 0
2 10 9 9 3 0
3 11 10 10 3 0
4 17 10 13 3 0
5 18 16 17 3 0
6 19 19 6 3 0
7 22 16 19 3 0
8 18 18 9 5 3
9 19 17 18 2 0
10 19 18 18 2 0
11 40 39 39 2 0
12 111 109 110 2 0
13 148 146 147 2 0
14 148 147 147 2 0
15 153 147 150 2 0
16 154 153 153 2 0
17 159 154 156 2 0
18 155 154 154 2 0
19 164 155 159 2 0
20 163 155 159 2 0

Network Data
Network id#: 1

OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US

Network id#: 2

OrgName: AT&T WorldNet Services
OrgID: ATTW
Address: 400 Interpace Parkway
City: Parsippany
StateProv: NJ
PostalCode: 07054
Country: US

Network id#: 3

OrgName: Level 3 Communications, Inc.
OrgID: LVLT
Address: 1025 Eldorado Blvd.
City: Broomfield
StateProv: CO
PostalCode: 80021
Country: US

Network id#: 4

OrgName: Level 3 Communications, Inc.
OrgID: LVLT
Address: 1025 Eldorado Blvd.
City: Broomfield
StateProv: CO
PostalCode: 80021
Country: US

Network id#: 5

OrgName: Level 3 Communications, Inc.
OrgID: LVLT
Address: 1025 Eldorado Blvd.
City: Broomfield
StateProv: CO
PostalCode: 80021
Country: US

Network id#: 6
Level (3) Communications
100 Leman Street
London
E1 8EU

Network id#: 7
Level (3) Communications
100 Leman Street
London
E1 8EU

Network id#: 8
Level (3) Communications
100 Leman Street
London
E1 8EU

Network id#: 9
Level (3) Communications
100 Leman Street
London
E1 8EU

Network id#: 10
Annankatu 44
00100 Helsinki
Finland

Network id#: 11
KPNQwest Finland Oy
Linnoitustie 4 B
FIN-02610 ESPOO
FINLAND

Network id#: 12
Linnoitustie 4 B
FIN-02610 ESPOO
Finland

Registrant Data
Registrant id#: 1
Registrant:
AT&T Corp. (ATT2-DOM)
55 Corporate Drive
Bridgewater, NJ 08807
US

Registrant id#: 2
See Registrant Pane for registrant contact information.

Registrant id#: 3
Registrant:
Jippii Group Oyj (EUNETIP-DOM)
Annankatu 44, FIN-00100 HELSINKI
FINLAND
No Valid City, No Valid State

Registrant id#: 4
Registrant ID:11-C
Registrant Name:SEE SPONSORING REGISTRAR
Registrant Street1:Whois Server:whois.opensrs.net
Registrant Street2:Referral URL:www.opensrs.org
Registrant City:N/A
Registrant Postal Code:N/A
Registrant Country:CA
Registrant Email:not@available.org
Admin ID:11-C
Admin Name:SEE SPONSORING REGISTRAR
Admin Street1:Whois Server:whois.opensrs.net
Admin Street2:Referral URL:www.opensrs.org
Admin City:N/A
Admin Postal Code:N/A
Admin Country:CA
Admin Email:not@available.org
Billing ID:11-C
Billing Name:SEE SPONSORING REGISTRAR
Billing Street1:Whois Server:whois.opensrs.net
Billing Street2:Referral URL:www.opensrs.org
Billing City:N/A
Billing Postal Code:N/A
Billing Country:CA
Billing Email:not@available.org
Tech ID:11-C
Tech Name:SEE SPONSORING REGISTRAR
Tech Street1:Whois Server:whois.opensrs.net
Tech Street2:Referral URL:www.opensrs.org
Tech City:N/A
Tech Postal Code:N/A
Tech Country:CA
Tech Email:not@available.org
Name Server:NS.SERVINT.COM
Name Server:NS2.SERVINT.COM

06-11-2003, 11:48 AM	#1 (permalink)
nazz Tilted Location: Land Of The Free	port scan attacks? Could you please shed any light on why my firewall would be reporting port scan attacks originating from catfish.tfproject.org? __________________ "Take my advice ... don't listen to me."

06-12-2003, 04:04 AM	#2 (permalink)
Sty Patron Administrator Location: Tôkyô, Japan	please c&p a part of your firewall log showing this behavior. __________________ br, Sty I route, therefore you exist

06-13-2003, 10:18 PM	#3 (permalink)
nazz Tilted Location: Land Of The Free	I'm sorry that I don't have all the info saved. It was Helsinki 193.64.21.130 and catfish.tfproject.org but that's all of the info I have. Next time I'll C&P it for you. Thanks. __________________ "Take my advice ... don't listen to me."

06-17-2003, 02:12 PM	#4 (permalink)
nazz Tilted Location: Land Of The Free	6 2 1 12.123.5.78 Chicago gbr2-p100.cgcil.ip.att.net 7 2 1 12.122.11.37 Chicago tbr1-p013602.cgcil.ip.att.net 8 2 1 12.123.6.33 Chicago ggr2-p300.cgcil.ip.att.net 9 3 2 209.0.227.77 Chicago so-1-1-0.edge1.chicago1.level3.net 10 4 2 209.244.8.9 Chicago so-2-1-0.bbr1.chicago1.level3.net 11 5 2 64.159.0.230 WASHINGTON D.C. so-0-1-0.bbr2.washington1.level3.net 12 6 2 212.187.128.133 Southwark so-0-0-0.mp2.london2.level3.net 13 7 2 212.187.128.225 Unknown so-4-1-0.mpls2.stockholm1.level3.net 14 8 2 213.242.68.52 Unknown gige5-1.hsipaccess2.stockholm1.level3.net 15 9 - 213.242.69.10 Unknown 16 10 3 213.192.191.129 Unknown so7-0-0-0.br1.esp1.fi.eunetip.net 17 10 3 213.192.191.45 Unknown ge2-3-0-0.br2.esp1.fi.eunetip.net 18 10 3 213.192.191.78 Unknown ge0-1-0-0.r1.alto.esp.fi.eunetip.net 19 11 3 212.226.252.82 Unknown gi2-0.r6.alto.esp.fi.eunetip.net 20 12 4 193.64.21.130 HELSINKI catfish.tfproject.org Packet Data Node High Low Avg Tot Lost 1 0 0 0 1 0 2 10 9 9 3 0 3 11 10 10 3 0 4 17 10 13 3 0 5 18 16 17 3 0 6 19 19 6 3 0 7 22 16 19 3 0 8 18 18 9 5 3 9 19 17 18 2 0 10 19 18 18 2 0 11 40 39 39 2 0 12 111 109 110 2 0 13 148 146 147 2 0 14 148 147 147 2 0 15 153 147 150 2 0 16 154 153 153 2 0 17 159 154 156 2 0 18 155 154 154 2 0 19 164 155 159 2 0 20 163 155 159 2 0 Network Data Network id#: 1 OrgName: Internet Assigned Numbers Authority OrgID: IANA Address: 4676 Admiralty Way, Suite 330 City: Marina del Rey StateProv: CA PostalCode: 90292-6695 Country: US Network id#: 2 OrgName: AT&T WorldNet Services OrgID: ATTW Address: 400 Interpace Parkway City: Parsippany StateProv: NJ PostalCode: 07054 Country: US Network id#: 3 OrgName: Level 3 Communications, Inc. OrgID: LVLT Address: 1025 Eldorado Blvd. City: Broomfield StateProv: CO PostalCode: 80021 Country: US Network id#: 4 OrgName: Level 3 Communications, Inc. OrgID: LVLT Address: 1025 Eldorado Blvd. City: Broomfield StateProv: CO PostalCode: 80021 Country: US Network id#: 5 OrgName: Level 3 Communications, Inc. OrgID: LVLT Address: 1025 Eldorado Blvd. City: Broomfield StateProv: CO PostalCode: 80021 Country: US Network id#: 6 Level (3) Communications 100 Leman Street London E1 8EU Network id#: 7 Level (3) Communications 100 Leman Street London E1 8EU Network id#: 8 Level (3) Communications 100 Leman Street London E1 8EU Network id#: 9 Level (3) Communications 100 Leman Street London E1 8EU Network id#: 10 Annankatu 44 00100 Helsinki Finland Network id#: 11 KPNQwest Finland Oy Linnoitustie 4 B FIN-02610 ESPOO FINLAND Network id#: 12 Linnoitustie 4 B FIN-02610 ESPOO Finland Registrant Data Registrant id#: 1 Registrant: AT&T Corp. (ATT2-DOM) 55 Corporate Drive Bridgewater, NJ 08807 US Registrant id#: 2 See Registrant Pane for registrant contact information. Registrant id#: 3 Registrant: Jippii Group Oyj (EUNETIP-DOM) Annankatu 44, FIN-00100 HELSINKI FINLAND No Valid City, No Valid State Registrant id#: 4 Registrant ID:11-C Registrant Name:SEE SPONSORING REGISTRAR Registrant Street1:Whois Server:whois.opensrs.net Registrant Street2:Referral URL:www.opensrs.org Registrant City:N/A Registrant Postal Code:N/A Registrant Country:CA Registrant Email:not@available.org Admin ID:11-C Admin Name:SEE SPONSORING REGISTRAR Admin Street1:Whois Server:whois.opensrs.net Admin Street2:Referral URL:www.opensrs.org Admin City:N/A Admin Postal Code:N/A Admin Country:CA Admin Email:not@available.org Billing ID:11-C Billing Name:SEE SPONSORING REGISTRAR Billing Street1:Whois Server:whois.opensrs.net Billing Street2:Referral URL:www.opensrs.org Billing City:N/A Billing Postal Code:N/A Billing Country:CA Billing Email:not@available.org Tech ID:11-C Tech Name:SEE SPONSORING REGISTRAR Tech Street1:Whois Server:whois.opensrs.net Tech Street2:Referral URL:www.opensrs.org Tech City:N/A Tech Postal Code:N/A Tech Country:CA Tech Email:not@available.org Name Server:NS.SERVINT.COM Name Server:NS2.SERVINT.COM __________________ "Take my advice ... don't listen to me."