Great Circle Associates Firewalls
(November 1996)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Portscan by Netmeeting
From: Darwin Martinez <darwin_martinez @ INS . COM>
Date: Mon, 04 Nov 1996 07:04:58 -0500
To: Greg . Donkin @ roke . co . uk
Cc: firewalls @ greatcircle . com

Using FW-1 here, and unfortunately when using NAT, FW-1 ver 3.0 is needed,
and not due out until later this year. BUT, when my client was trying this
app, I didn'd see what you are referring to. Just the applicable ports
needed by NetMeeting, no portscanning. Hope this helps.

At 09:21 AM 11/4/96 PST, you wrote:
>
>The other day i was looking at the logs from our Firewall-1 and saw a 
>portscan starting at port 1 all the way up to 65535. Of course i start 
>looking at it further & discover it's come from the *inside* of the wall. 
>Looks like one of the users has been playing around, so pausing only to 
>pick up the office baseball bat on the way out, i go to have a quiet word, 
>but when i talked to him he said it's part of the beta Netmeeting 2 from 
>our old chums Microsoft. I haven't looked at it myself but i'd take our 
>guy's word for it. He says it's a few lines of VBasic which looks for a 
>port to use. Seems to me this is, how shall i put it? Irresponsible? 
>Designed to piss off Firewall administrators?
>
>Anyone else come across this? Anyone from M$ care to comment?
>
>Greg
>
>Greg Donkin             Email: Greg .
 Donkin @
 roke .
 co .
 uk
>
>Siemens Business Services at Roke Manor Research
>
>#include <std.disclaimer.h>
>
>
>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Darwin L. Martinez                    Voice:  404-843-5954
Network Systems Engineer              Pager:  888-346-1320
International Network Services        Vmail:  770-641-4004
Atlanta Office                        Email:  darwin_martinez @
 ins .
 com

<http://www.ins.com/>

"Let him who hath understanding reckon the number of the beast."
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^


Indexed By Date Previous: Re: NCSA membership
From: Tony Iannotti <tony @ fozzie . secapl . com>
Next: Sun Screen experiance
From: dtosic @ delta . Tymnet . COM (Dragan Tosic)
Indexed By Thread Previous: Re: Portscan by Netmeeting
From: Robert Hanson <roberth @ cet . com>
Next: RE: MIMESweeper
From: Andrew Bays <andrew @ zeuros . co . uk>

Google
 
Search Internet Search www.greatcircle.com