I just installed WallWatcher about 2 weeks ago to view my router log file from my Linksys router. I get lots of port scans. In the a 2 day log file I have 1981 probes. Some interesting things are the IP's. I am using NeoTrace to track the IP's and the most active are:
201 hits from IP 218.15.192.64 (Unknown).
157 hits from IP 207.68.171.232 (Microsoft).
117 hits from IP 168.143.107.163 (Unknown).
106 hits from IP 64.156.39.12 (dialup-64.156.39.12.dial1.denver1.level3.net).
105 hits from IP 200.152.97.160 (PROXYBLOCKER.COM.BR).
58 hits from IP 207.68.172.245 (Microsoft).
37 hits from IP 12-209-135-1 ( 12-209-135-1.client.attbi.com).
The most active ports are: 80, 1025, 1026, 1027, 1028, 57952, 57333.
I am no network expert but am hoping someone could give me a hand. One should I be concerned about all these probes. Two is there anything I can do about them. They are all being blocked. Three why would I be getting probed from Microsoft? The Microsoft ones are trying post 80 but requesting local ports 1554 to 2919 in a short amount of time.
Anyone got any ideas?
Thanks
Opossum
201 hits from IP 218.15.192.64 (Unknown).
157 hits from IP 207.68.171.232 (Microsoft).
117 hits from IP 168.143.107.163 (Unknown).
106 hits from IP 64.156.39.12 (dialup-64.156.39.12.dial1.denver1.level3.net).
105 hits from IP 200.152.97.160 (PROXYBLOCKER.COM.BR).
58 hits from IP 207.68.172.245 (Microsoft).
37 hits from IP 12-209-135-1 ( 12-209-135-1.client.attbi.com).
The most active ports are: 80, 1025, 1026, 1027, 1028, 57952, 57333.
I am no network expert but am hoping someone could give me a hand. One should I be concerned about all these probes. Two is there anything I can do about them. They are all being blocked. Three why would I be getting probed from Microsoft? The Microsoft ones are trying post 80 but requesting local ports 1554 to 2919 in a short amount of time.
Anyone got any ideas?
Thanks
Opossum
