cancel
Showing results for 
Search instead for 
Did you mean: 

Strange Port Scan?

N/A

Strange Port Scan?

In my Netgear Router log I found this strange entry.

It shows a Plusnet DNS server attempt a port scan on one of my internal IPs.

Source:212.159.13.150 Destination:192.168.0.4 - [PORT SCAN] Sun, 2005-01-09 18:24:35

Source:212.159.13.150 Destination:192.168.0.4 - [PORT SCAN] Sun, 2005-01-09 18:24:53

Source:212.159.13.150 Destination:192.168.0.4 - [PORT SCAN] Sun, 2005-01-09 18:25:07

Three times within a few minutes but not again since then.

Anyone any ideas why this would be here and what it is about?

Regards.
3 REPLIES
N/A

Strange Port Scan?

what kind of port scan, as it could just be the servers checking ur connection is still alive
N/A

Strange Port Scan?

I'm unable to tell other than 'UDP Packet'
Community Veteran
Posts: 14,469
Registered: 30-07-2007

Strange Port Scan?

Is 13.150 the DNS servers you use? If so, these must be changed to 212.159.13.49 & .50 or 212.159.6.9 & .10 or you should set your system/router up to obtain it automatically.

13.150 & 11.150 are being decommissioned very soon and should no longer be used.

If 13.150 is your DNS server, they are most likely delayed lookup replies which have arrived too late and after the original request has closed the ports. Because of this the router has received a reply on a port that is no longer open so reports it in the log. It is not a port scan as the DNS servers don't scan plusnet IPs, they just reply to DNS requests and sometimes that reply takes too long to get back.