Whos scanning my ports??

condra

This is the message my firewall gives me every now and then....

"
Somebody is scanning your computer.
Your computer's TCP ports:
135, 1025, 445, 6129 and 80 have been scanned from 159.134.158.252."

Ive had this happen with different IP addresses but usually that one.

I am an eircom flat rate dial up customer and a glad x esat customer and I think 159.134.158.252 might just be ESAT- If so, I WOULD BE PRETTY DAMN FURIOUS.. :mad:

Ive some questions:
Is scanning my ports legal?
What harm can be done or information shared by my ports being scanned?
Does 159 at the start mean its an Irish IP? Could it be Esat??
I have the SP2 firewall off usually coz it causes problems.. Would having it on prevent anyone from scanning my ports?

Thanks in advance anyone... I am so pissed off at the amount of crap that goes on with the internet. I only recently installed a "free download manager" which completely f@(*#d up my system but thats another story altogether.

ESAT ARE SCOURGE EITHER WAY.

peace.

Tivoli

give me your ip address and i'll let you know what i can find

i have scanned ports from work before, its great way to get mp3's

but to be honest a lot of virii/trojans would spend their time scanning ports and the user would not be aware so i doupt it is illegal, as he can't be blaimed


edit-oh and i think it is someone with an eircom.net dsl or dial-up account

what problems is the firewall causing, you shoudn't be on the net without it

SantaHoe

C:\WINDOWS>nslookup 159.134.158.252
Server: ns5.ns.esat.net
Address: 194.125.2.241

Name: 159-134-158-252.as1.bbh.dublin.eircom.net
Address: 159.134.158.252

Is scanning my ports legal?

I think it is yeah... or else it's just something that no isp will bother their arse following up on, I forget which... either way, nobodys going to jail for scanning your ports.

What harm can be done or information shared by my ports being scanned?

Basically nothing.
Since you have been alerted you to these scans/probes it has most likely your firewall also blocked the attempt and no 'information' has been sent from these ports.
The only way any 'information' is going to be gotten is if the port scan reveals open ports on your system and the open ports have insecure services or trojans running behind them that the attacker knows how to exploit.
To this end, keep your OS patched up with security updates, use a good virus-scanner with up-to-date virus signatures, disable any unused services, and have a respectable firewall running... set good passwords for user logons, and don't keep your credit card details in a text file on your desktop.

Really though, I wouldn't get freaked out... port scans are hugely common and it doesn't mean someone's singled you out and desperately wants to hack you... these programs have the ability to scan whole ranges of IP addresses... scanning thousands of PCs just to see if there are any poor suckers out there with trojans etc.

You seem paranoid about esat for some reason, I honestly don't think they're trying to r00t you because you cancelled your subscription(?!)
Even if they did, I seriously doubt they know exactly what IP address eircom have assigned you on any given logon.
My advise is to just chill out... there are plenty of guides out there for keeping your PC pretty secure from online muppets, follow the guidelines and forget about it.
If it's really bothering you to the point where you can't relax at all, just take anything you wouldn't want some random person seeing (diary/financial info/memoirs) off your PC and keep it on a floppy or usb stick... instant peace of mind.

condra

Hey USB stick is a good idea for private stuff. Ill do that.
Im not paranoid its just that elsewhere a search pointed me to Esat.

I dont use the firewall coz it stopped my FTP but Ill just have to learn how to use it one of these days. Its all good. Thanks.

I guess Im just a bit worried bout my pC health coz theres a whole load of processes goin on and every now and then the machine goes mad for about a minute even if Im not running anything intensive. :cool:

SantaHoe

Well the first thing to do is find out if you're at risk.
Some usefull links:

Symantec run a free scan from their website, I'd reccomend doing both.
As far as I know, their online virus scan doesn't remove viruses, but it'll certainly tell you if you've got one.
http://security.symantec.com/sscv6/default.asp?productid=symhome&langid=ie&venid=sym

Also run the "Shields up" test at:
http://www.grc.com
This one port-scans you and lets you know what ports may be vulnerable on your PC.
They give some very good plain-english descriptions of what's going on... it's well worth taking your time and reading through this thing.
(note: after clicking on the link from that page, there'll be a whole list of other things on the next page, just scroll down to "Shields up")

You should scan for spyware aswell. (google for AdAware and Spybot Search and Destroy)