Re: warning message from portsentry

[Pollywog <croak@shadypond.com>]

On 2001.12.20 19:04 rick@niof.net wrote:
> What does this warning mean and what is causing it?
>
> > Dec 20 12:02:10 tc portsentry[540]: attackalert: Possible stealth scan
> > from unknown host to TCP port: 111 (accept failed)
>
> I get it when I run a 2.4 kernel but not when I run a 2.2 kernel so I
> believe it's something internal to my system. There are hundreds of them
> every hour.

That appears to be Portmapper.  If you are not using it, disable it or 
remove it.  Otherwise  go into your Portsentry config and remove port 111 
from the list of ports Portsentry monitors.


--
Andrew