Karl
Wed Oct 22 09:25:56 CDT 2003
"Patrick Rouse [MVP]" <anonymous@discussions.microsoft.com> wrote in message
news:078701c397ee$c9817120$a001280a@phx.gbl...
> I used to report these to the FBI when they came from
> outside the USA but I've gotten lazy. I noticed yesterday
> our firewall dropped 17 SubSeven Attacks. One host tried
> 4 times but the others came from all over the place.
FBI really can't handle port scans, I wouldn't report them to them. [unless
maybe you're talking the former NIPC, which AFAIK just does tracking and not
actual law enforcement]
> Are these bots attempting these or actual idiots w/
> nothing better to do? Should I just ignore them? Maybe
> there 's a public website where we can post the hostnames
> of the computers that launch these, or someone who keeps a
> database of such things.
There are. Go see the free software www.mynetwatchman.com and
www.dshield.org [a.k.a. www.incidents.org ] These benefit you as well, as
you get information on what other IP addresses have been scanned.
I wouldn't be too worried about port scans that are blocked. These happen
every day if not every hour. You definitely want to automate your response
to the noisiest ones instead of trying to do it manually. Do note that some
of these can be false alarms as well.