possible scanning, hacking

Posted on 2007-11-30
Last Modified: 2008-02-01
Seeking some help to see if someone is trying to hack my network or do some kind of scan to see open ports. I have created a capture for asp drops and noticed some weird things. These IP's are from Ontario Canada, China, Hong Kong, US and Bejing. Keep in mind I don't thing anyone should be connecting to us from either of these except the US. I saw similar outputs from an IP in each of these cities/countries so far 5 total. The thing that points out to me is there is only one valid ip address below that is configured on my network. Any advice is appreciated.

1044: 14:21:55.132897 > S 1132473078:1132473078(0) win 16384 <mss 1460,nop,nop,sackOK>
1045: 14:21:55.139061 > S 1132516126:1132516126(0) win 16384 <mss 1460,nop,nop,sackOK>
1046: 14:21:55.141640 > S 1132581203:1132581203(0) win 16384 <mss 1460,nop,nop,sackOK>
1047: 14:21:55.145393 > S 1132622646:1132622646(0) win 16384 <mss 1460,nop,nop,sackOK>
1048: 14:21:55.154304 > S 1132658065:1132658065(0) win 16384 <mss 1460,nop,nop,sackOK>
1049: 14:21:55.165122 > S 1132703273:1132703273(0) win 16384 <mss 1460,nop,nop,sackOK>
1050: 14:21:55.165167 > S 1132738620:1132738620(0) win 16384 <mss 1460,nop,nop,sackOK>
1051: 14:21:55.172644 > S 1132790881:1132790881(0) win 16384 <mss 1460,nop,nop,sackOK>
1052: 14:21:55.172690 > S 1132843933:1132843933(0) win 16384 <mss 1460,nop,nop,sackOK>
1053: 14:21:55.179846 > S 1132902316:1132902316(0) win 16384 <mss 1460,nop,nop,sackOK>
1054: 14:21:55.182287 > S 1132949182:1132949182(0) win 16384 <mss 1460,nop,nop,sackOK>
1055: 14:21:55.188222 > S 1132990645:1132990645(0) win 16384 <mss 1460,nop,nop,sackOK>
1056: 14:21:55.192800 > S 1133046972:1133046972(0) win 16384 <mss 1460,nop,nop,sackOK>
1057: 14:21:55.196584 > S 1133100069:1133100069(0) win 16384 <mss 1460,nop,nop,sackOK>
1058: 14:21:55.206562 > S 1133143838:1133143838(0) win 16384 <mss 1460,nop,nop,sackOK>
1059: 14:21:55.206593 > S 1133206532:1133206532(0) win 16384 <mss 1460,nop,nop,sackOK>
Question by:wilsj
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
LVL 13

Expert Comment

ID: 20385217
Everyone of those IPs are from Proxy's.  Hackers use proxies so when you trace the IP it won't show their actual IP address.  They are scanning your network for open ports, etc.

Make sure your server is secure by downloading a tool that scans your network (most likely the same tool the hackers are using) and prevent them from accessing your server illegally.  The program is called Nessus, it can be downloaded here:

It will let you know if you have any port open thats unnecessary.  It will also let you know of any vulnerabilites on your server.

LVL 25

Accepted Solution

Cyclops3590 earned 500 total points
ID: 20386046
its a recon scan looking for an open rpc port. info:

either the host is deliberately running this type of scan (and script kiddie at that as its purely incremental for ips), or they are infected with a virus.

While Nessus is a good tool to check the security vulnerabilities of a system, having an IDS, like snort, to detect these types of attacks and alert you or have an IPS (which is an addon module to the 5520) can actually pro-actively kill off these attacks when detected.  In this case, it'd see the same IP scanning the same port on multiple ips and know its a scan attack then block them

Author Comment

ID: 20386969
I will try configuring the AIP-SSM-10 on monday. My only concern is how much will this slow down processing?
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 25

Expert Comment

ID: 20388247
it shouldn't by much as the IPS functions are offloaded to the module.  however I'd put it in detection mode first to see what all its alerting about, then after you feel comfortable its detecting the correct stuff, you can start blocking it.

also, this would be a good time to take a baseline performance of your asa.  then another after you configure the ips; then compare to see if there is truely a noticeable difference.

Author Comment

ID: 20395799
I also have a 2851 ISR with IPS. Should I start with configuring the router IPS first?
LVL 25

Expert Comment

ID: 20398853
whichever you wish to do the IPS functionality.

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There is a lot to be said for protecting yourself and your accounts with 2 factor authentication.  I found to my own chagrin, that there is a big downside as well.
Article by: Justin
In light of the WannaCry ransomware attack that affected millions of Windows machines, you might wonder if your Mac needs protecting. Yes, it does and here is how to do it.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
Suggested Courses

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question