cancel
Showing results for 
Search instead for 
Did you mean: 

WHy is Plusnet scanning all of my ports?

suec45
Grafter
Posts: 566
Registered: ‎02-10-2007

WHy is Plusnet scanning all of my ports?

Hi guys, I recently loaded up 'peerguardian' and found that the IP  '212.159.13.50' was scanning my ports serially, it had got to port 1651 and was continuing 1652, 1653 etc.
Now 2 hours later its at port 4134 and continuing 4135, 4136 etc.
The IP is for PLusnets DNS server
Can anyone tell me whats going on?
2 REPLIES 2
gary
Grafter
Posts: 108
Registered: ‎10-04-2007

Re: WHy is Plusnet scanning all of my ports?

Shot in the dark, it might help.
212.159.13.50 is the first DNS server most customer are assigned with.
Background internet noise causes DNS lookups, e.g. an infected PC port scanning you in some crazey way then causing a lookup for each scan..... then interpreted by your software as a port scan from the DNS server.
I saw this a lot with netgear routers when I used to work in the call centre.
I can assure our DNS servers would not be port scanning you Smiley
gary
Grafter
Posts: 108
Registered: ‎10-04-2007

Re: WHy is Plusnet scanning all of my ports?

Or actually .... now i'm thinking straight! Your PC could be infected with a virus port scanning other people and the software is interpreting the 'returned' lookup rquests as port scans.
Thats probably closer to the mark.