Port Scanning

[seekermeister]

I had a series of port scans this evening, which I determined were done by my cable provider. Is there any legitimate reason why this needs to be done?

 

[Lemur]

I think (it's possible) ISPs can search for torrents.

 

[seekermeister]

Maybe, but I just checked and all of the ports listed are unassigned, except 3 that are dynamic and or private, with no further description given. The only torrent that I ever use is 8901, when using TVU Player, so the others appear to be unrelated.

 

[Lemur]

Which ports were checked?

 

[seekermeister]

If you click on the screenshot in my OP, you will see most of them listed in the Attack Type column.

 

[SledgeDG]

it's almost impossible to read if you don't have a zoom function

44530, 47090, 47346, 47602
48882, 49650, 49906, 49394
12481, 12737, 12993, 13246

Your ISP is Cox? NetRange70.167.150.0 - 70.167.151.255
Those Portscans aren't run by Cox themselves but by someone who has his account with Cox just like you.
Just because they are assigned that 70.167.150.0 - 70.167.151.255 block doesn't mean they use it themselves

The second Block 94.0.0.0 - 94.255.255.255 is from GB and is assigned to VirginMedia.net
Apparently a UK-ISP

I don't recognize any of those ports. so I assume, somebody plays with a script and doesn't really know what they're doing
-DG

 

[Lemur]

I agree. The ports are unassigned.

http://www.iana.org/assignments/port-numbers

Don't know what they could be looking for.

 

[seekermeister]

it's almost impossible to read if you don't have a zoom function

44530, 47090, 47346, 47602
48882, 49650, 49906, 49394
12481, 12737, 12993, 13246

Your ISP is Cox? NetRange70.167.150.0 - 70.167.151.255
Those Portscans aren't run by Cox but by someone who has his account with Cox just like you.
Just because they are assigned that 70.167.150.0 - 70.167.151.255 block doesn't mean they use it themselves

Hmm, I ran Sam Spade on the IPs and they only pointed to Cox. If it were another account holder, wouldn't it point to him, rather than just Cox?

 

[Lemur]

it's almost impossible to read if you don't have a zoom function

44530, 47090, 47346, 47602
48882, 49650, 49906, 49394
12481, 12737, 12993, 13246

Your ISP is Cox? NetRange70.167.150.0 - 70.167.151.255
Those Portscans aren't run by Cox but by someone who has his account with Cox just like you.
Just because they are assigned that 70.167.150.0 - 70.167.151.255 block doesn't mean they use it themselves

Hmm, I ran Sam Spade on the IPs and they only pointed to Cox. If it were another account holder, wouldn't it point to him, rather than just Cox?

What if you ran Sam Spade on your IP. What would it show? It would not show a user name.

 

[Lemur]

Try this with your ip address:

WHOIS Lookup for Domain & IP Address Research | Whois Source

and the found ip.

Is it similar?

 

[seekermeister]

Okay, the bottom line is whether there is some way to pinpoint the actual person performing the attack, or at least get an idea of what he is trying to do?

 

[SledgeDG]

Especially since ISPs started to give out Dynamic IPs ther is no way of knowing, what user is behind such a scan. You would need the timestamp log from the ISPs in question.

Sam Spade..I used to have that under XP...(out of sight out of mind) gotta go and d/l it again.
Thanks for reminding me

-DG

 

[SledgeDG]

To pinpoint, what they're really up to, you need a list of ports used by Trojans/Bots and other malware..I used to have such lists...maybe I'll find them again

 

[Lemur]

Agreed. You need to contact your ISP and let them know the date and time your pc was scanned. The person doing it might even be ignorant of the fact - if a rogue virus or malware is behind it. But they need to know.

 

[seekermeister]

Try this with your ip address:

WHOIS Lookup for Domain & IP Address Research | Whois Source

and the found ip.

Is it similar?

I ran both of the IPs involved by using your link, and all that it gives is a much more detailed list of data than Sam Spade did. However, it appears that it is not the local Cox office doing it, but the one in Atlanta, GA.

 

[pparks1]

I'm almost positive this is not your ISP, but as others said somebody on their network.

As to why they do it...who knows? Maybe they are script kiddies, maybe their boxes have been compromised by somebody else (most likely) and they are scanning.

I often have a Linux box taking incoming requests from the net and you can see truckloads of users trying to run Windows scripts against my Linux box. They simply scan a range of IP's and then thing they are really doing something fancy. You can tell they are running scripts as it just cycles through test, after test, after test...even though it should be obvious right from the start that they aren't going to gain access to cmd on my host.

 

[SledgeDG]

Right...when I used Comodo Firewall I got swamped with those Attack messages.
At first I was all concerned and tried to investigate every case.
Then I got defensive and crashed their comp through a by then unpatched loophole in winsock and don't you know...most of them were gone for a reboot so you knew those were script kiddies on a windows box.
Now I run the Windows firewall (in addition to my router fw) and don't worry about them anymore.
Obviously your safe since your Firewall caught/stopped the event.
Basically it's just "white noise" on the cable...not worth losing any sleep over.
The dangerous ones are those, your firewall doesn't tell you about

-DG