What do you do when somebody repeatedly tries to scan ports on your computer?

Question

For a few days now, my firewall has been telling me that somebody from IP 123.134.95.199 has been trying to scan ports 3128, 7212, 8000, 8080, 8118, 8800 and 9090 on my single computer in L.A. Is there a way for me to do something that will make his machine go up in a puff of smoke? Seriously, though...

Answer 1

just ignore it. there is not much you can do which has any effect on the 'attacker'. if your ports are closed then there is nothing you should be afraid of.

you can obviously start to script your packetfilter to drop packets from machines which try to scan you more than X times a day ... but i tend to claim that this is useless.

Answer 2

You could always have some fun with them. If you're really good, (far better than I) you could write a program that listens on those ports and mimics the responses for common programs (like a webserver on 8080) and then starts giving them weird data after a while. It really wouldn't accomplish what you want (i.e. their computer wouldn't spontaneously explode) but it would demonstrate that you're on to them and frustrate them a bit.

Answer 3

Big surprise:

123.134.95.199    CHINA UNICOM SHANDONG PROVINCE NETWORK    DYPTT.SD.CN

Bots from China and Russia have been trying to scan my ports (and probably yours too) for ten years. The only thing you can do about it is stay firewalled and ignore it.

Answer 4

Ban the IP address. If you really want to take an active response, you can use a program like wireshark to record the attack, and send the RELEVANT recorded packets and other attack details to their ISP. You can find their ISP (for a certain definition of ISP) using whois with their IP address.