Detect port scanning application installed

English Network/Internet
1

Hi all

I have a server which I manage with SSH. There are a few times that my server firewall blocked my IP because it detected my pc is doing port scanning on the server. So I would like to identify if there’s any port scanning application installed in my openSuSe, which made port scanning to the server. So how can I identify this ? using netstat to detect outgoing traffic from my pc ?

Thanks

2

What openSUSE version are you running on the system you think is r unning a port scanning program? We can not know when you keep this secret.

And it is very unlikely that your openSUSE system (whatever version) is running a port scanning program without you (the system manager I presume) knowing that you installed, configured and started it.

3

Hi

I am using openSuSe 12.1 (for other details, I can’t give now, I am not at my pc now)

That’s what I thought too, I did not start any such application as I aware of. However, according to the server log it detected my IP doing port scanning, that’s why I need to know some tools that can help me track the mystery.

Thanks

4

I see you are troubling your fingers in using the Shift key a lot, but it is openSUSE, a bit easier then what you make out of it.

My idea would be to get a more detailed report out of that “server” system. At what time, how often, etc.
You may then be able to link that to you trying to login, but forgetting/mistyping the password, a coworker being on shift or something.

Also a

ps -ef

might show you what program with conspicious name is running on your system.

And you can try

netstat -atp

to see if there is anything strange.

Maybe other know more extensive network scanners.

5

Hi,

Thanks for the help. Now the mystery is revealed, it was due to my pc IP had changed and no longer in the allowed host to access MySQL server, so when I tried to login with Mysql Workbench, it fail and if I still try to click on the Data Export and Restore, my server will log the same error of port scanning had happened.

Thanks

6

In the line of my first suggestion. Glad I could calm you down and bring you back to logical thinking. rotfl!rotfl!