June 2002 - WLUG - wlug.mailman3.com

RE: [Wlug] Who is port scanning me?

by Simoncini, Matthew

Hi again, Over the weekend, I received some "creative" feedback and all of it is appreciated. Why question was intended to find an easy way to track down the owner of an IP address within our corporate network (unregistered with DNS/WINS). Not to hack, crack, spam, or DOS them, but to gain information on that particular node. I have to bring this IP address to the attention of our Security Team, but wanted more information to give them. Given all the feedback, it seems easier just to contact the Security Team and let them figure this out. Thanks again for your time. Matthew -----Original Message----- From: Phillip G Deneault [mailto:deneault@WPI.EDU] Sent: Sunday, June 23, 2002 9:27 PM To: wlug(a)mail.wlug.org Subject: Re: [Wlug] Who is port scanning me? Chances are the machine that is performing the portscan is hacked himself. It does no good to "hack them back" because your not hacking the hackers...your hacking the hack. :-) On top of that, you'll only cloud the issue and, if the matter is taken to the authorities, you could also get in trouble. Not to mention the entire concept of hacking without authorization is unethical and illegal. I'm going to go say its not worth it. This does happen constantly if your connected to the Internet. Your best offense is a good defense. Phil On Sun, 23 Jun 2002, Michael Frysinger wrote: > try and hack them back???????? > or just move on because it doesnt matter that much. > in the real world that shit happens all the time > -mike > > On Sunday 23 June 2002 08:42 am, David Goss wrote: > > and if it is a hacker???... what's the best way to send them back a little > > something to let them know you care??? > > > > dave goss > > > > > > ----- Original Message ----- > > From: "George Metz" <wolfstar(a)shadownet.wox.org> > > To: <wlug(a)mail.wlug.org> > > Sent: Sunday, June 23, 2002 12:49 AM > > Subject: Re: [Wlug] Who is port scanning me? > > > > > On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > > > > Hi everyone, > > > > > > > > I'm constantly getting port scanned from a certain IP address on our > > > > internal corporate network. I'd really like to find out where and who > > > > this > > > > > > person is, but don't know much outside of ping, traceroute, nslookup, > > > > etc > > > > > > .... I was wondering if anyone knows of any tools that can get me more > > > > information on this person? This happens to be on our private network, > > > > so > > > > > > most internet tools I don't think will help much. > > > > > > If it's on your internal net, then talking to the network admins for your > > > site should give you a good idea of where they're at and why they're > > > doing it. > > > > > > If there's no network admin on site, then you'll have to do some footwork > > > yourself. The suggestion to use IPTables to ignore data from that address > > > is a good one if possible; you might even be able to track down the > > > culprit when they suddenly can't access your system anymore and ask why. > > > (Possible if it's a somehow compromised system on the internal network.) > > > > > > Another possibility is using host or nslookup if you've got internal > > > nameservers behind whatever's running your NAT setup (I'm making the > > > assumption that you're running NAT if you're on a private net.) > > > > > > If you happen to be the guy who's had Network admin position shoved upon > > > you, then you can try getting a null route added to the router for your > > > net connection at work and use that to see who complains about a sudden > > > lack of net access too, but I'd definitely be careful of that method. =) > > > > > > -- > > > George Metz > > > Commercial Routing Engineer > > > wolfstar(a)shadownet.wox.org > > > > > > "We know what deterrence was with 'mutually assured destruction' during > > > the Cold War. But what is deterrence in information warfare?" -- > > > Brigadier General Douglas Richardson, USAF, Commander - Space Warfare > > > Center > > > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Phil Deneault "We work in the dark, We do what we can, deneault(a)wpi.edu We give what we have. Our doubt is our passion, WPI NetOps and our passion is our task. The rest is the OpenVMS Guy maddness of art." - Henry James -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- _______________________________________________ Wlug mailing list Wlug(a)mail.wlug.org http://mail.wlug.org/mailman/listinfo/wlug

June 24, 2002

Re: [Wlug] Who is port scanning me?

by Phillip G Deneault

Chances are the machine that is performing the portscan is hacked himself. It does no good to "hack them back" because your not hacking the hackers...your hacking the hack. :-) On top of that, you'll only cloud the issue and, if the matter is taken to the authorities, you could also get in trouble. Not to mention the entire concept of hacking without authorization is unethical and illegal. I'm going to go say its not worth it. This does happen constantly if your connected to the Internet. Your best offense is a good defense. Phil On Sun, 23 Jun 2002, Michael Frysinger wrote: > try and hack them back???????? > or just move on because it doesnt matter that much. > in the real world that shit happens all the time > -mike > > On Sunday 23 June 2002 08:42 am, David Goss wrote: > > and if it is a hacker???... what's the best way to send them back a little > > something to let them know you care??? > > > > dave goss > > > > > > ----- Original Message ----- > > From: "George Metz" <wolfstar(a)shadownet.wox.org> > > To: <wlug(a)mail.wlug.org> > > Sent: Sunday, June 23, 2002 12:49 AM > > Subject: Re: [Wlug] Who is port scanning me? > > > > > On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > > > > Hi everyone, > > > > > > > > I'm constantly getting port scanned from a certain IP address on our > > > > internal corporate network. I'd really like to find out where and who > > > > this > > > > > > person is, but don't know much outside of ping, traceroute, nslookup, > > > > etc > > > > > > .... I was wondering if anyone knows of any tools that can get me more > > > > information on this person? This happens to be on our private network, > > > > so > > > > > > most internet tools I don't think will help much. > > > > > > If it's on your internal net, then talking to the network admins for your > > > site should give you a good idea of where they're at and why they're > > > doing it. > > > > > > If there's no network admin on site, then you'll have to do some footwork > > > yourself. The suggestion to use IPTables to ignore data from that address > > > is a good one if possible; you might even be able to track down the > > > culprit when they suddenly can't access your system anymore and ask why. > > > (Possible if it's a somehow compromised system on the internal network.) > > > > > > Another possibility is using host or nslookup if you've got internal > > > nameservers behind whatever's running your NAT setup (I'm making the > > > assumption that you're running NAT if you're on a private net.) > > > > > > If you happen to be the guy who's had Network admin position shoved upon > > > you, then you can try getting a null route added to the router for your > > > net connection at work and use that to see who complains about a sudden > > > lack of net access too, but I'd definitely be careful of that method. =) > > > > > > -- > > > George Metz > > > Commercial Routing Engineer > > > wolfstar(a)shadownet.wox.org > > > > > > "We know what deterrence was with 'mutually assured destruction' during > > > the Cold War. But what is deterrence in information warfare?" -- > > > Brigadier General Douglas Richardson, USAF, Commander - Space Warfare > > > Center > > > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Phil Deneault "We work in the dark, We do what we can, deneault(a)wpi.edu We give what we have. Our doubt is our passion, WPI NetOps and our passion is our task. The rest is the OpenVMS Guy maddness of art." - Henry James -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

June 24, 2002

Re: [Wlug] Who is port scanning me?

by Michael Frysinger

try and hack them back???????? or just move on because it doesnt matter that much. in the real world that shit happens all the time -mike On Sunday 23 June 2002 08:42 am, David Goss wrote: > and if it is a hacker???... what's the best way to send them back a little > something to let them know you care??? > > dave goss > > > ----- Original Message ----- > From: "George Metz" <wolfstar(a)shadownet.wox.org> > To: <wlug(a)mail.wlug.org> > Sent: Sunday, June 23, 2002 12:49 AM > Subject: Re: [Wlug] Who is port scanning me? > > > On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > > > Hi everyone, > > > > > > I'm constantly getting port scanned from a certain IP address on our > > > internal corporate network. I'd really like to find out where and who > > this > > > > person is, but don't know much outside of ping, traceroute, nslookup, > > etc > > > > .... I was wondering if anyone knows of any tools that can get me more > > > information on this person? This happens to be on our private network, > > so > > > > most internet tools I don't think will help much. > > > > If it's on your internal net, then talking to the network admins for your > > site should give you a good idea of where they're at and why they're > > doing it. > > > > If there's no network admin on site, then you'll have to do some footwork > > yourself. The suggestion to use IPTables to ignore data from that address > > is a good one if possible; you might even be able to track down the > > culprit when they suddenly can't access your system anymore and ask why. > > (Possible if it's a somehow compromised system on the internal network.) > > > > Another possibility is using host or nslookup if you've got internal > > nameservers behind whatever's running your NAT setup (I'm making the > > assumption that you're running NAT if you're on a private net.) > > > > If you happen to be the guy who's had Network admin position shoved upon > > you, then you can try getting a null route added to the router for your > > net connection at work and use that to see who complains about a sudden > > lack of net access too, but I'd definitely be careful of that method. =) > > > > -- > > George Metz > > Commercial Routing Engineer > > wolfstar(a)shadownet.wox.org > > > > "We know what deterrence was with 'mutually assured destruction' during > > the Cold War. But what is deterrence in information warfare?" -- > > Brigadier General Douglas Richardson, USAF, Commander - Space Warfare > > Center > > > > _______________________________________________ > > Wlug mailing list > > Wlug(a)mail.wlug.org > > http://mail.wlug.org/mailman/listinfo/wlug > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug

June 24, 2002

Re: [Wlug] Who is port scanning me?

by Karl Hiramoto

What I would try is setting up a firewall LOG chain in iptables. Have iptables default to closed/drop ports on a host. with the log chain you could see who is attempting to access the closed/drop ports. \ This would track the offending IP. IP adress fake? Not sure on that one. Should give you some usefull info though. On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > Hi everyone, > > I'm constantly getting port scanned from a certain IP address on our > internal corporate network. I'd really like to find out where and who this > person is, but don't know much outside of ping, traceroute, nslookup, etc > .... I was wondering if anyone knows of any tools that can get me more > information on this person? This happens to be on our private network, so > most internet tools I don't think will help much. > > Thanks for your time. > > Matthew -- ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø Karl Hiramoto <karl(a)hiramoto.org> Work: 978-425-2090 ext 25 Cell: 508-517-4819 Personal web page: http://karl.hiramoto.org/ Zoop Productions: http://www.zoop.org/ KTEQ Rapid City: http://www.kteq.org/ AOL IM ID = KarlH420 Yahoo_IM = karl_hiramoto ¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø QOTD: "Like this rose, our love will wilt and die."

June 23, 2002

Re: [Wlug] Who is port scanning me?

by David Goss

and if it is a hacker???... what's the best way to send them back a little something to let them know you care??? dave goss ----- Original Message ----- From: "George Metz" <wolfstar(a)shadownet.wox.org> To: <wlug(a)mail.wlug.org> Sent: Sunday, June 23, 2002 12:49 AM Subject: Re: [Wlug] Who is port scanning me? > On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > > > Hi everyone, > > > > I'm constantly getting port scanned from a certain IP address on our > > internal corporate network. I'd really like to find out where and who this > > person is, but don't know much outside of ping, traceroute, nslookup, etc > > .... I was wondering if anyone knows of any tools that can get me more > > information on this person? This happens to be on our private network, so > > most internet tools I don't think will help much. > > If it's on your internal net, then talking to the network admins for your > site should give you a good idea of where they're at and why they're doing > it. > > If there's no network admin on site, then you'll have to do some footwork > yourself. The suggestion to use IPTables to ignore data from that address > is a good one if possible; you might even be able to track down the > culprit when they suddenly can't access your system anymore and ask why. > (Possible if it's a somehow compromised system on the internal network.) > > Another possibility is using host or nslookup if you've got internal > nameservers behind whatever's running your NAT setup (I'm making the > assumption that you're running NAT if you're on a private net.) > > If you happen to be the guy who's had Network admin position shoved upon > you, then you can try getting a null route added to the router for your > net connection at work and use that to see who complains about a sudden > lack of net access too, but I'd definitely be careful of that method. =) > > -- > George Metz > Commercial Routing Engineer > wolfstar(a)shadownet.wox.org > > "We know what deterrence was with 'mutually assured destruction' during > the Cold War. But what is deterrence in information warfare?" -- Brigadier > General Douglas Richardson, USAF, Commander - Space Warfare Center > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug >

June 23, 2002

Re: [Wlug] Who is port scanning me?

by George Metz

On Fri, 21 Jun 2002, Simoncini, Matthew wrote: > Hi everyone, > > I'm constantly getting port scanned from a certain IP address on our > internal corporate network. I'd really like to find out where and who this > person is, but don't know much outside of ping, traceroute, nslookup, etc > .... I was wondering if anyone knows of any tools that can get me more > information on this person? This happens to be on our private network, so > most internet tools I don't think will help much. If it's on your internal net, then talking to the network admins for your site should give you a good idea of where they're at and why they're doing it. If there's no network admin on site, then you'll have to do some footwork yourself. The suggestion to use IPTables to ignore data from that address is a good one if possible; you might even be able to track down the culprit when they suddenly can't access your system anymore and ask why. (Possible if it's a somehow compromised system on the internal network.) Another possibility is using host or nslookup if you've got internal nameservers behind whatever's running your NAT setup (I'm making the assumption that you're running NAT if you're on a private net.) If you happen to be the guy who's had Network admin position shoved upon you, then you can try getting a null route added to the router for your net connection at work and use that to see who complains about a sudden lack of net access too, but I'd definitely be careful of that method. =) -- George Metz Commercial Routing Engineer wolfstar(a)shadownet.wox.org "We know what deterrence was with 'mutually assured destruction' during the Cold War. But what is deterrence in information warfare?" -- Brigadier General Douglas Richardson, USAF, Commander - Space Warfare Center

June 23, 2002

Re: [Wlug] Who is port scanning me?

by Joe Riopel

You could download Sam Spade ( I only know of a windows version ). It will give you a good amount of information about an IP address. -Joe

June 21, 2002

Re: [Wlug] Who is port scanning me?

by Peter Gutowski

On Friday, June 21, 2002 4:24 PM, Simoncini, Matthew <Matthew.Simoncini(a)bsci.com> wrote: >Hi everyone, > >I'm constantly getting port scanned from a certain IP address on our >internal corporate network. I'd really like to find out where and who this >person is, but don't know much outside of ping, traceroute, nslookup, etc >.... I was wondering if anyone knows of any tools that can get me more >information on this person? This happens to be on our private network, so >most internet tools I don't think will help much. > >Thanks for your time. > >Matthew >_______________________________________________ >Wlug mailing list >Wlug(a)mail.wlug.org >http://mail.wlug.org/mailman/listinfo/wlug > With iptables (upgrade to ipchains and so much more sophisticated) installed you can configure it to ignore *any* packet sent from that machine [defining it by IP address or MAC address] -- responding (or not, this case) as if your computer were turned off. Works for me. -- Peter Gutowski <peter(a)linuxchamps.com> // tel.: (413) 531-0123 "When in company, put not your hands to any part of the body not usually discovered." --George Washington, _Rules for Civility and Decent Behavior_

June 21, 2002

Who is port scanning me?

by Simoncini, Matthew

Hi everyone, I'm constantly getting port scanned from a certain IP address on our internal corporate network. I'd really like to find out where and who this person is, but don't know much outside of ping, traceroute, nslookup, etc .... I was wondering if anyone knows of any tools that can get me more information on this person? This happens to be on our private network, so most internet tools I don't think will help much. Thanks for your time. Matthew

June 21, 2002

Re: [Wlug] browser war

by Charles R. Anderson

On Thu, Jun 20, 2002 at 12:25:17PM -0400, Bill Smith wrote: wsmith> ahhh... and for the last few months, i've been using Galeon... 8\ That doesn't count as separate from Mozilla. It's still Gecko. -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

June 20, 2002