North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Port 139 scans

  • From: vern
  • Date: Thu Sep 28 12:57:42 2000 
> I am particularly concerned over this issue of these broadcasts
> originating from Concentric.net

I don't think they particularly are.  Here at lbl.gov (128.3/16), we're
getting scanned from cmu.edu (128.2/16).  nersc.gov (128.55/16) is getting
scanned from ucsd.edu (128.54/16).  So it could well be that the ones being
scanned from concentric.net are simply those with nearby address blocks,
and it's just one small part of rampant scanning from all over the place.

By the way, we identified a couple instances of the virus that Ken Lindahl
mentioned in his earlier post.

		Vern