cancel
Showing results for 
Search instead for 
Did you mean: 

How to deal with port attack.

N/A

How to deal with port attack.

Guys, I need some advice. I've had someone port scanning my development server for a few days now...he's trying to get in on the MSSQL port (1433) which does exist but has sicne been closed since that port no long needs to be open for development. I've also blocked all attempts to access that port on the router (Netgear DG834). See an extract of the log below:

Sat, 2005-08-13 13:00:05 - TCP Packet - Source:84.55.76.162,17872 Destination:1.0.0.0,1433 - [Any(ALL) match]
Sat, 2005-08-13 13:00:44 - TCP Packet - Source:84.55.76.162,23852 Destination:1.0.0.0,1433 - [Any(ALL) match]
Sat, 2005-08-13 13:01:36 - UDP Packet - Source:218.92.13.146,33669 Destination:192.168.0.2,1026 - [Any(ALL) match]
Sat, 2005-08-13 13:01:40 - TCP Packet - Source:84.55.76.162,30980 Destination:1.0.0.0,1433 - [Any(ALL) match]
Sat, 2005-08-13 13:02:03 - TCP Packet - Source:84.55.76.162,34103 Destination:1.0.0.0,1433 - [Any(ALL) match]
Sat, 2005-08-13 13:02:43 - TCP Packet - Source:84.55.76.162,39059 Destination:1.0.0.0,1433 - [Any(ALL) match]

Since that IP address is blocked its not causing me any problems but would like to try and stop it. It's probably a zombie machine or something. I've mailed the abuse address I found doing a dns lookup but I dont expect a quick response from that, is there anything PN can do their end?

- J.
3 REPLIES
craigbrass
Grafter
Posts: 1,009
Registered: 30-07-2007

How to deal with port attack.

If you have blocked it, there is no need to do anything more. It cannot cause you harm after that.

There is nothing PlusNet can do to stop it btw.
N/A

How to deal with port attack.

It is probably a virus or worm infected machine that is behind the attack. The IP is in a block belonging to ownit.se. You could try e-mailing their abuse desk abuse@ownit.se

Rob
craigbrass
Grafter
Posts: 1,009
Registered: 30-07-2007

How to deal with port attack.

But there is also the question of if they speak english or not. Most likely if not it will go right into "Deleted Items" lol.