Re: Port 12345?

[Robert Waldner <Waldner@KPNQwest.at>]

On 28 Nov 2000 02:03:51 PST, Willy Lee writes:
>How can I tell when I am being portscanned?>

By looking at your log-files, I don´t have them at hand now, but if you 
 see something like:

ip fw-in deny <bla> <your_ip>:21
ip fw-in deny <bla> <your_ip>:22
ip fw-in deny <bla> <your_ip>:98
ip fw-in deny <bla> <your_ip>:137
ip fw-in deny <bla> <your_ip>:138
...

then that´s a _strong_ indication.

>  Is there an appropriate
>selection of Debian packages for this?

I wouldn´t know of one.

hth,
&rw
-- 
/  Ing. Robert Waldner  | Network Engineer | T: +43 1 89933  F: x533 \ 
\ <Waldner@KPNQwest.at> |    KPNQwest/AT   | Diefenbachg. 35, A-1150 /