Ekstern portscanning frå 127.0.0.1:80 ?

[bentose]

Har nyleg oppdaga ein del portscanning frå 127.0.0.1:80

Trudde først at det var mi eiga maskin som hadde fått anfall, men dette må

vel vere nokon utanfor min SMC Barricade router, men innanfor Tele2 sin

nærmaste router?

 

Bent

 

 

3. november 2003 20:39:38 Unrecognized access from 127.0.0.1:80 to TCP port 1670

3. november 2003 20:40:18 Unrecognized access from 68.212.12.195:5579 to UDP port 137

3. november 2003 20:40:47 Unrecognized access from 193.217.162.136:3474 to TCP port 135

3. november 2003 20:40:50 Unrecognized access from 193.217.162.136:3474 to TCP port 135

3. november 2003 20:41:19 Unrecognized access from 217.232.11.12:30175 to UDP port 137

3. november 2003 20:41:23 Unrecognized access from 81.218.121.47:3840 to TCP port 135

3. november 2003 20:41:25 Unrecognized access from 81.218.121.47:3840 to TCP port 135

3. november 2003 20:43:06 Unrecognized access from 127.0.0.1:80 to TCP port 1001

3. november 2003 20:43:13 Unrecognized access from 200.65.99.152:1047 to UDP port 137

3. november 2003 20:43:33 Unrecognized access from 200.65.104.13:1027 to UDP port 137

3. november 2003 20:45:52 Unrecognized access from 127.0.0.1:80 to TCP port 1159

3. november 2003 20:46:16 Unrecognized access from 212.160.188.196:1028 to UDP port 137

3. november 2003 20:46:39 Unrecognized access from 200.67.219.188:1030 to UDP port 137

3. november 2003 20:50:08 Unrecognized access from 127.0.0.1:80 to TCP port 1790

3. november 2003 20:51:16 Unrecognized access from 127.0.0.1:80 to TCP port 1226

3. november 2003 20:53:01 Unrecognized access from 127.0.0.1:80 to TCP port 1095

3. november 2003 20:53:31 Unrecognized access from 148.233.166.149:60921 to UDP port 137

3. november 2003 20:55:22 Unrecognized access from 127.0.0.1:80 to TCP port 1240

3. november 2003 20:56:20 Unrecognized access from 61.48.0.172:1872 to TCP port 135

3. november 2003 20:56:29 Unrecognized access from 61.48.0.172:1872 to TCP port 135

3. november 2003 20:58:07 Unrecognized access from 193.217.165.112:2295 to TCP port 135

3. november 2003 20:58:10 Unrecognized access from 193.217.165.112:2295 to TCP port 135

[bitcowboy]

Hei,

 

127.0.0.1:80 viser til din egen maskin. 127.0.0.1 adressen er "localhost" og finnes ikke der ute på internet ... :80 betyr at dette foregår på port 80 (vanligvis http-traffik) har du kjørt noe programvare for å oppdage eventuelle "trojanske hester" eller lignende (adware osv.)?

[bentose]

Eg er klar over at mi maskin også har IP addresse 127.0.0.1, men køyrde både

AD-Aware og SpyBot for å sjekke utan at dei fann noko.

Mi maskin skulle også ha alle rettigheiter overfor routeren så den burde ikkje verte

stoppa.

 

For å vere sikker så drog eg ut nettverkskabelen 22:09 og sette den innatt no

22:30 i mellomtida har eg fått følgande: (pluss ein del andre meir normale)

 

3. november 2003 22:14:47 Unrecognized access from 127.0.0.1:80 to TCP port 1730

3. november 2003 22:16:30 Unrecognized access from 127.0.0.1:80 to TCP port 1608

3. november 2003 22:19:20 Unrecognized access from 127.0.0.1:80 to TCP port 1542

3. november 2003 22:19:38 Unrecognized access from 127.0.0.1:80 to TCP port 1038

3. november 2003 22:21:12 Unrecognized access from 127.0.0.1:80 to TCP port 1790

3. november 2003 22:29:24 Unrecognized access from 127.0.0.1:80 to TCP port 1816

 

Står vel noko om dette på

 

http://www.dslreports.com/forum/remark,779...art=4~mode=flat

 

Bent

[enden]

hvis loggen er i routeren så er det routeren som er 127.0.0.1 ikke maskinen din. Alle er sin egen localhost. Men jeg synes det høres merkelig ut at routern portscanner seg selv. Mer merkelig enn om en maskin hadde gjort det