[31559] in North American Network Operators' Group
Re: Port 139 scans
daemon@ATHENA.MIT.EDU (vern@ee.lbl.gov)
Thu Sep 28 12:56:45 2000
Message-Id: <200009281654.e8SGsrd25514@daffy.ee.lbl.gov>
From: vern@ee.lbl.gov
To: linneweh@concentric.net
Cc: nanog@merit.edu
In-reply-to: Your message of Thu, 28 Sep 2000 07:40:04 PDT.
Date: Thu, 28 Sep 2000 09:54:53 PDT
Errors-To: owner-nanog-outgoing@merit.edu
> I am particularly concerned over this issue of these broadcasts
> originating from Concentric.net
I don't think they particularly are. Here at lbl.gov (128.3/16), we're
getting scanned from cmu.edu (128.2/16). nersc.gov (128.55/16) is getting
scanned from ucsd.edu (128.54/16). So it could well be that the ones being
scanned from concentric.net are simply those with nearby address blocks,
and it's just one small part of rampant scanning from all over the place.
By the way, we identified a couple instances of the virus that Ken Lindahl
mentioned in his earlier post.
Vern
