Solved

Port scanning: what would cause it from a PC?

Posted on 2009-07-02
4
230 Views
Last Modified: 2013-12-25
A client is being blocked about once a week from our (LAMP, Cpanel, with IFD firewall) server because of Port Scanning.

What in a PC would cause port scanning from his home isp connection, and how to curtail?

thanks!
0
Comment
Question by:willsherwood
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 12

Accepted Solution

by:
kevin_u earned 200 total points
ID: 24768073
If it is really port scanning, its a virus, trojan and the computer may be part of a botnet.  If that PC and/or that user has access to any sensitive information, I'd deny access until it is cleared up.
0
 
LVL 16

Assisted Solution

by:SteveJ
SteveJ earned 300 total points
ID: 24798672
"What in a PC would cause port scanning from his home isp connection, and how to curtail?"

A user with a little bit of knowledge playing with a tool downloaded from the internet that he really doesn't understand.

I agree with kevin u . . . block him until that nonsense stops.

Good luck,
SteveJ
0
 

Author Comment

by:willsherwood
ID: 24799957
the client's PC is idle overnight, he has anti-virus.
doesn anything that's non malicious do port scanning?
0
 
LVL 16

Assisted Solution

by:SteveJ
SteveJ earned 300 total points
ID: 24803269
That depends: if the range is very small . . . sure some apps will try to connect over a small range of ports because they are somewhat firewall savvy and as you say their intention is non-malicious. However, as the range of ports gets larger, it begins to be a stretch to call them non-malicious regardless of their intent because of the consequence.

What is the range of ports being scanned?

Good luck,
SteveJ
0

Featured Post

Secure Your WordPress Site: 5 Essential Approaches

WordPress is the web's most popular CMS, but its dominance also makes it a target for attackers. Our eBook will show you how to:

Prevent costly exploits of core and plugin vulnerabilities
Repel automated attacks
Lock down your dashboard, secure your code, and protect your users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let’s list some of the technologies that enable smooth teleworking. 
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question