RE: Constantly being Port Scanned by same IP address
- From: "Steven Sporen" <sporens@xxxxxxxxxxx>
- To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
- Date: Fri, 22 Feb 2002 14:21:05 +0200
Hi,
Contact your upstream provider if it's really bad. They can block hole
the route on their side (Thus it won't even come down your line). Or add
a route on your ISP router to route the IP to a null interface. Have you
contacted the owners of the machine and their service provider? Use a
tool like Sam Spade (http://www.samspade.org/ssw/) to retrieve domain
information as well as IP registration information.
I always send to abuse@xxxxxxxx, postmaster@xxxxxxx and noc@xxxxxxx
where xxx is the upstream providers IP address.
Realise that being on the Internet means you will get port scanned -
just one of those facts of life.
Regards
Steven
-----Original Message-----
From: DB [mailto:daniel.bourne@xxxxxxx]
Sent: 22 February 2002 01:45
To: [ISAserver.org Discussion List]
Subject: [isalist] Constantly being Port Scanned by same IP address
http://www.ISAserver.org
I am constantly being port scanned by one particular IP address. In ISA
server, is there a way I can block all inbound and outbound access to
this IP address? I am new to ISA Server (and firewalls in general) so I
hope this makes sense. I receive at least two port scans a day from
this IP.
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
sporens@xxxxxxxxxxx To unsubscribe send a blank email to
$subst('Email.Unsub')
Other related posts:
