was i being hacked or scanned?

[CyberCowboy]

all my computers were off.
then all of a sudden, I see the activity light on my modem stay on for a second or two, (which prob means that a lot of stuff was being sent to my modem, and it ain't no ARP request).

so i turn on my computer and check the logs on my router and this is what i see:

09/11/2002 12:20:10 Unrecognized access from 66.208.24.242:8035 to TCP port 1433
09/11/2002 12:20:13 Unrecognized access from 66.208.24.242:8035 to TCP port 1433
09/11/2002 12:20:20 Unrecognized access from 66.208.24.242:8035 to TCP port 1433


anyone have any ideas as to what was trying to access my computers? This seems so bizarre to me.

 

[Descartes]

That's the MS SQL Server port, usually. There have been flaws in it's authentication architecture and worms created to exploit said flaws. It's probably just the worm itself trying to find exploitable servers...

 

[Doggiedog]

On that note, I've got a Netgear router attached to my cable modem. The PCs are usually off but the router I leave on.

Is that a bad idea? Do I compromise my router by leaving it on? I notice alot of activity on my cable modem too because it's plugged in all the time. If I unplug the modem for a few seconds will that solve anything since I have dynamic IP?

 

[CyberCowboy]

oh.. it must be a popular worm..
because I looked at my logs again and there are about 5 more unrecognized accesses on port 1433... all accesses from different ip addresses.

good thing my router protects me.

 

[rahvin]

Originally posted by: CyberCowboy
oh.. it must be a popular worm..
because I looked at my logs again and there are about 5 more unrecognized accesses on port 1433... all accesses from different ip addresses.

good thing my router protects me.

During the height of code red/nimba I was getting over 200+ scans a day in my logs.

 

I always get scanned. No big deal. Half of my scans come from Germany for some reason.

 

[CyberCowboy]

haha.. dude..
i want to disconnect my router and capture those packets to see what is in them...

i am fighting the urge though....

 

[rgwalt]

I get a lot of access attempts for ports 1433, 80, and 21. I'm very glad I have a router.

Ryan