Why so many port scans?

Nssca · Oct 5, 2009

Someone in my area (according to my firewalls back trace) keeps doing a port scan on my PC.
Is this the ISP or LE?
I run a proxy most of the time, could this prompt a port scan.
The scans have been coming about every 30 min for about a day now
Thanks for any info regarding this.

Kaiser · Oct 5, 2009

Probably your ISP if it just started. Did you do a reverse lookup on the IP to see where it originated? Also, you will know fairly simply if it is an IP from the same subnet. Is this all ports or just things like 139, 21 & 25?

Nssca · Oct 5, 2009

Kaiser said:
Probably your ISP if it just started. Did you do a reverse lookup on the IP to see where it originated? Also, you will know fairly simply if it is an IP from the same subnet. Is this all ports or just things like 139, 21 & 25?

It is a local ip, when I do reverse look up and only 3-4 ports are said to be scanned

Kaiser · Oct 6, 2009

DaRooster said:
It is a local ip, when I do reverse look up and only 3-4 ports are said to be scanned

Local IP? You mean a 192.168.x.x or a 10.x.x.x? If so, you have malware on one of your computers on your INTERNAL network, without a doubt. No one external can talk on those nets so, I would suggest you take the hard drives out of your other PCs and stick them in a known good PC to scan them in case the AV on them cannot detect the virus such as a rootkit. The reason I say this is because I know you are somewhat skilled so I am skipping the whole "download and install a good AV solution"

VanR__ · Oct 7, 2009

Could be the ISP auditing. They send out ICMPs to check for commercial services.
If he's behind a gateway (RFC 1918 192.168.etc..), he should not be getting TCP scanned anyways.

Kaiser · Oct 7, 2009

VanR__ said:
Could be the ISP auditing. They send out ICMPs to check for commercial services.
If he's behind a gateway (RFC 1918 192.168.etc..), he should not be getting TCP scanned anyways.

Unless the ports he is talking about are forwarded within the router/firewall/proxy to his client computer, there is no way the scan can be a 192.168.x.x or 10.x.x.x subnet. Those IPs are unroutable over the internet. That is unless he has malware on his client PC that is setting the route.