• Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Portscan by a user, can't find it, *help!*

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2000 General] >> General >> Portscan by a user, can't find it, *help!* Page: [1]
Message << Older Topic   Newer Topic >>
Portscan by a user, can't find it, *help!* - 26.May2006 2:40:04 AM   


Posts: 7
Joined: 4.May2004
Status: offline
Well, I need help on this one...

Config is ISA server, 170 computers behind the ISA Server 2000...

The thing is, there's a computer inside the network that is port-scanning at the dest. port 5900 (VNC) but it's scanning a whole classB... Of course, the ISP has called us and advised us that they had a complaint about port scanning a whole subnet for connection on port 5900 but not only 5900... Everyday, there's a port scan on another port and for the past few days, there's complaint about different ports... Now my question:

I thought I would be able to search the log files for "5900" and find out that for example, IP as sent a packet to port 5900 but it's not the case, I find *NOTHING* in the logs.  The three logs are put to "LOG ALL"... 

Any help would be welcomed, if it's not clear enough, let me know, blocking *.outbound and opening the needed ports is not currently a solution since they are a firm who use PCI cards and need full-outbound access.  I don't know all the details about why they need *.outbound access but I would definitly like to find the computer who is infected or port scanning.

Thanx in advance,

Post #: 1

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2000 General] >> General >> Portscan by a user, can't find it, *help!* Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts