[newbie] Port scan attack

Mandriva 2008.1, cable modem, 4 port Belkin wired router.
In the past couple of days my internet connection has slowed down,
possibly by a factor of ten, and yesterday and this morning the system
has been subject to a port scanning attack. The system displayed a
message indicating that it was mounted by my router and showed a button
"Process attack". That disappeared before I could react, replaced by a
flashing warning triangle in the panel so I wondered if there was any
way to reactivate the Process Attack option. Does anybody know what it
does? Reverse DNS lookup maybe and an opportunity to blacklist the
source somehow?
The attack has stopped but it would be handy to know what to do if it
were repeated.
Len

____________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________

Well since I have not seen you get a reply this is the best I can offer. I
do not use a router, on a very slow dial-up, and am running 2010. I get port
scanned allot(I know on dial-up? ;>}) and what I do is right click the
network icon in the lower right. I then select the interactive firewall, I
then select the offending IP in the window and click the "blacklist" button.
If there are more than one, quite often, I select each intern and blacklist
them.
Good luck;
On Mon, Feb 1, 2010 at 11:02 PM, Len Lawrence wrote:
> Mandriva 2008.1, cable modem, 4 port Belkin wired router.
>
> In the past couple of days my internet connection has slowed down, possibly
> by a factor of ten, and yesterday and this morning the system has been
> subject to a port scanning attack. The system displayed a message
> indicating that it was mounted by my router and showed a button "Process
> attack". That disappeared before I could react, replaced by a flashing
> warning triangle in the panel so I wondered if there was any way to
> reactivate the Process Attack option. Does anybody know what it does?
> Reverse DNS lookup maybe and an opportunity to blacklist the source
> somehow?
>
> The attack has stopped but it would be handy to know what to do if it were
> repeated.
>
> Len
>
>
>
>
> ____________________________________________________
> Want to buy your Pack or Services from Mandriva? Go to
> http://store.mandriva.com
> Join the Club : http://www.mandrivaclub.com
> ____________________________________________________
>
--
Roly
rolanddothughesatgmaildotcom
I read somewhere that if you manage your money perfectly, you would never
run out, but the check that you wrote for your funeral should bounce. ;>)
____________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________

Roland Hughes wrote:
> Well since I have not seen you get a reply this is the best I can
> offer. I do not use a router, on a very slow dial-up, and am running
> 2010. I get port scanned allot(I know on dial-up? ;>}) and what I do
> is right click the network icon in the lower right. I then select the
> interactive firewall, I then select the offending IP in the window and
> click the "blacklist" button. If there are more than one, quite often,
> I select each intern and blacklist them.
> Good luck;
>
> On Mon, Feb 1, 2010 at 11:02 PM, Len Lawrence > wrote:
>
> Mandriva 2008.1, cable modem, 4 port Belkin wired router.
>
> In the past couple of days my internet connection has slowed down,
> possibly by a factor of ten, and yesterday and this morning the
> system has been subject to a port scanning attack. The system
> displayed a message indicating that it was mounted by my router
> and showed a button "Process attack". That disappeared before I
> could react, replaced by a flashing warning triangle in the panel
> so I wondered if there was any way to reactivate the Process
> Attack option. Does anybody know what it does? Reverse DNS
> lookup maybe and an opportunity to blacklist the source somehow?
>
> The attack has stopped but it would be handy to know what to do if
> it were repeated.
>
> Len
>
>
>
> --
> Roly
> rolanddothughesatgmaildotcom
>
> I read somewhere that if you manage your money perfectly, you would
> never run out, but the check that you wrote for your funeral should
> bounce. ;>)
Thanks for the reply. At one point I did go into the interactive
firewall where two numbers were registered against two addresses, both
the address of the router. The numbers might have been PIDs. So it
looked like the attacker reached the router and mounted the attack from
there. I had hoped that the Process Attack option would have a way to
identify the attacker's address(es). There has been no more trouble
today and network speed seems to be back to normal.
Sorry to hear that your connection is so limited. The last thing you
would want is a port scan attack.
Len
____________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________

Did you put in a "REAL GOOD" admin password? A lot of people know the
defaults and can own your router. I used a linksys years ago and put in a 30
character password, even then I was nervous.
On Tue, Feb 2, 2010 at 3:39 PM, Len Lawrence wrote:
> Roland Hughes wrote:
>
>> Well since I have not seen you get a reply this is the best I can offer. I
>> do not use a router, on a very slow dial-up, and am running 2010. I get port
>> scanned allot(I know on dial-up? ;>}) and what I do is right click the
>> network icon in the lower right. I then select the interactive firewall, I
>> then select the offending IP in the window and click the "blacklist" button.
>> If there are more than one, quite often, I select each intern and blacklist
>> them.
>> Good luck;
>>
>> On Mon, Feb 1, 2010 at 11:02 PM, Len Lawrence lcl@tarazed.demon.co.uk>> wrote:
>>
>> Mandriva 2008.1, cable modem, 4 port Belkin wired router.
>>
>> In the past couple of days my internet connection has slowed down,
>> possibly by a factor of ten, and yesterday and this morning the
>> system has been subject to a port scanning attack. The system
>> displayed a message indicating that it was mounted by my router
>> and showed a button "Process attack". That disappeared before I
>> could react, replaced by a flashing warning triangle in the panel
>> so I wondered if there was any way to reactivate the Process
>> Attack option. Does anybody know what it does? Reverse DNS
>> lookup maybe and an opportunity to blacklist the source somehow?
>>
>> The attack has stopped but it would be handy to know what to do if
>> it were repeated.
>>
>> Len
>>
>>
>>
>> --
>> Roly
>> rolanddothughesatgmaildotcom
>>
>> I read somewhere that if you manage your money perfectly, you would never
>> run out, but the check that you wrote for your funeral should bounce. ;>)
>>
> Thanks for the reply. At one point I did go into the interactive firewall
> where two numbers were registered against two addresses, both the address of
> the router. The numbers might have been PIDs. So it looked like the
> attacker reached the router and mounted the attack from there. I had hoped
> that the Process Attack option would have a way to identify the attacker's
> address(es). There has been no more trouble today and network speed seems
> to be back to normal.
>
> Sorry to hear that your connection is so limited. The last thing you would
> want is a port scan attack.
>
>
> Len
>
>
> ____________________________________________________
> Want to buy your Pack or Services from Mandriva? Go to
> http://store.mandriva.com
> Join the Club : http://www.mandrivaclub.com
> ____________________________________________________
>
--
Roly
rolanddothughesatgmaildotcom
I read somewhere that if you manage your money perfectly, you would never
run out, but the check that you wrote for your funeral should bounce. ;>)
____________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________

On Tuesday, February 2, 2010, 5:19:25 PM, Roland Hughes wrote:
RH> Did you put in a "REAL GOOD" admin password? A lot of people know
RH> the defaults and can own your router. I used a linksys years ago
RH> and put in a 30 character password, even then I was nervous.
Might also want to disable remote admin if that option is possible,
and you don't need to do it.
--
rikona
____________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________

Roland Hughes wrote:
> Did you put in a "REAL GOOD" admin password? A lot of people know the
> defaults and can own your router. I used a linksys years ago and put
> in a 30 character password, even then I was nervous.
Good advice. Just done that - time it was changed anyway.
Len
____________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________

rikona wrote:
> On Tuesday, February 2, 2010, 5:19:25 PM, Roland Hughes wrote:
>
> RH> Did you put in a "REAL GOOD" admin password? A lot of people know
> RH> the defaults and can own your router. I used a linksys years ago
> RH> and put in a 30 character password, even then I was nervous.
>
> Might also want to disable remote admin if that option is possible,
> and you don't need to do it.
>
Another good tip. I have now enabled administration from workstation only.
One thing that is odd about this router is that it cannot be managed
properly from Mozilla Firefox but Konqueror allows full interaction.
Len
____________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________