For a few days now, my firewall has been telling me that somebody from IP 123.134.95.199 has been trying to scan ports 3128, 7212, 8000, 8080, 8118, 8800 and 9090 on my single computer in L.A. Is there a way for me to do something that will make his machine go up in a puff of smoke? Seriously, though...
1
-
1I looked up the IP address you gave me. It appears the person who is scanning the ports on your computer is from China.– ephilipOct 17, 2009 at 1:54
Add a comment
|
4 Answers
just ignore it. there is not much you can do which has any effect on the 'attacker'. if your ports are closed then there is nothing you should be afraid of.
you can obviously start to script your packetfilter to drop packets from machines which try to scan you more than X times a day ... but i tend to claim that this is useless.
You could always have some fun with them. If you're really good, (far better than I) you could write a program that listens on those ports and mimics the responses for common programs (like a webserver on 8080) and then starts giving them weird data after a while. It really wouldn't accomplish what you want (i.e. their computer wouldn't spontaneously explode) but it would demonstrate that you're on to them and frustrate them a bit.
answered Oct 16, 2009 at 17:53
-
1
-
3Be warned though. If the attacker is malicious, then you're more likely to annoy them enough that they'll try to destroy your computer in retaliation. Unfortunately, I've seen it happen to a friend who made one mildly insulting remark about a Russian hacker group.– Tom AOct 16, 2009 at 18:08
-
@Tom Very good point, nasty people are probably better left alone...still fun to think about though :-) Oct 17, 2009 at 8:22
Big surprise:
123.134.95.199 CHINA UNICOM SHANDONG PROVINCE NETWORK DYPTT.SD.CN
Bots from China and Russia have been trying to scan my ports (and probably yours too) for ten years. The only thing you can do about it is stay firewalled and ignore it.
Ban the IP address. If you really want to take an active response, you can use a program like wireshark to record the attack, and send the RELEVANT recorded packets and other attack details to their ISP. You can find their ISP (for a certain definition of ISP) using whois with their IP address.
