Newsgroup: it.comp.sicurezza.windows
Titolo: Tutti fanno scansioni sulla porta 4672

Ciao, uso Windows XP SP2 con ZA. Vedo parecchi tentativi di connessioni
sulla mia porta 4672 da parte di centinaia di IP diversi, ognuno dei
quali prova a connettersi a me tramite il protocollo UDP; ecco un
estratto del file di log di ZA:
FWIN,2005/12/20,16:25:30 +1:00
GMT,
190.48.20.104:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:32 +1:00
GMT,
221.219.126.20:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:34 +1:00
GMT,
151.41.144.101:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:34 +1:00
GMT,
83.112.226.84:5600
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:34 +1:00
GMT,
83.33.108.79:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:36 +1:00
GMT,
151.54.86.238:1725
,
151.44.42.86:4662
,TCP (flags:S)
FWIN,2005/12/20,16:25:36 +1:00
GMT,
82.106.224.165:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:38 +1:00
GMT,
80.132.237.216:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:40 +1:00
GMT,
85.75.211.171:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:40 +1:00
GMT,
82.80.4.13:6672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:42 +1:00
GMT,
81.250.153.61:25489
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:42 +1:00
GMT,
81.33.165.51:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:42 +1:00
GMT,
71.106.21.55:50268
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:42 +1:00
GMT,
83.39.117.249:16753
,
151.44.42.86:4662
,TCP (flags:S)
FWIN,2005/12/20,16:25:46 +1:00 GMT,
88.5.77.5:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:46 +1:00
GMT,
201.124.25.137:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:48 +1:00
GMT,
213.45.24.210:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:48 +1:00
GMT,
82.233.181.7:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:52 +1:00
GMT,
84.228.55.58:6672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:52 +1:00
GMT,
212.80.64.166:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:52 +1:00
GMT,
222.181.143.2:51678
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:54 +1:00
GMT,
82.159.76.51:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:56 +1:00
GMT,
213.84.211.120:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:56 +1:00
GMT,
151.51.50.152:1755
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:58 +1:00
GMT,
82.55.83.6:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:25:58 +1:00
GMT,
83.27.209.198:5437
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:00 +1:00
GMT,
82.235.184.73:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:00 +1:00
GMT,
84.40.142.84:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:02 +1:00
GMT,
83.34.126.71:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:02 +1:00
GMT,
84.223.3.29:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:02 +1:00
GMT,
85.137.21.50:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:02 +1:00
GMT,
84.6.11.209:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:02 +1:00
GMT,
81.13.194.117:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:02 +1:00
GMT,
81.247.177.124:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:04 +1:00
GMT,
83.49.238.181:8590
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:06 +1:00
GMT,
193.204.182.32:58871
,
151.44.42.86:4662
,TCP (flags:S)
FWIN,2005/12/20,16:26:06 +1:00
GMT,
82.253.95.194:3218
,
151.44.42.86:4662
,TCP (flags:S)
FWIN,2005/12/20,16:26:08 +1:00
GMT,
200.122.109.215:5001
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:08 +1:00
GMT,
81.32.199.84:5783
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:12 +1:00
GMT,
80.35.73.189:56936
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:12 +1:00
GMT,
84.97.175.246:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:12 +1:00
GMT,
217.70.75.145:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:12 +1:00
GMT,
172.210.183.239:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:12 +1:00
GMT,
151.44.83.198:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:26:12 +1:00
GMT,
83.27.25.9:4672
,
151.44.42.86:4672
,UDP
FWIN,2005/12/20,16:29:32 +1:00
GMT,
24.118.75.87:1441
,
151.44.186.220:6348
,TCP (flags:S)
FWIN,2005/12/20,16:29:32 +1:00
GMT,
24.118.75.87:6348
,
151.44.186.220:6348
,UDP
FWIN,2005/12/20,16:31:18 +1:00
GMT,
87.202.103.239:27710
,
151.44.186.220:6348
,UDP
FWIN,2005/12/20,16:31:34 +1:00
GMT,
84.13.80.152:18603
,
151.44.186.220:6348
,UDP
FWIN,2005/12/20,16:33:02 +1:00
GMT,
82.55.91.98:2979
,
151.44.186.220:6346
,TCP (flags:S)
Come mai?
Grazie!!!

 
di niente
pep

Ciao, sono un amico di Mauix, gli ho scritto io il post. Immaginavo una
domanda del genere. No, non usa nulla di tutto ciò. Ha solo la barra
di Ebay attiva. Ma anche quando gliel'ho disattivata il bombardamento
continuava :-(

continuava :-(
Puo essere capitato questo.
Un utente eMule era collegato con un certo indirizzo IP.
Questi si e' scollegato, liberando l'IP, e subito dopo si e' collegato il
tuo amico, che ha preso lo stesso IP dell'utente di prima.
Di conseguenza, tutti quelli che erano nella coda eMule dell'utente di
prima, ora tentano l'accesso al PC del tuo amico, che ha la sola "colpa"
di possedere lo stesso IP dell'eMulAtore. ;-)
Se il fenomeno si verifica sporadicamente, e' una spiegazione plausibile.
Ciao! :-)
-- 
-----
  | NFINITY is so far as you want to see.
-----
Se vuoi rispondermi in E-Mail, ripassa le divisioni. ;-)