View Single Post
Old 04-27-2008, 02:22 PM   #4 (permalink)
johnhook
Tech Hardware Team
 
johnhook's Avatar
 
Join Date: Apr 2008
Posts: 810
OS: MS SBS 2003 SP2


Re: Port scans causing denial of service [moved from General Security}

tetonbob,

What link did you go to to resolve those addresses to "Telewest Broadband IP Network Services " ? Just curious. It's been awhile since I've had to look up ip addresses of attacks on my PC. I found that most of those attacks came from Seoul Korea. It's kind of confusing as to which authority/organization controls domain names/ip addresses for various countries. I know that Networksolutions.com pretty much handles all of the US domain names.

Blockhead,

The main thing is to simply permanently BLOCK the offending IPs in your firewall software. If you find lots of attacks coming from the same IP network, i.e. 62.30.x.x - you may want to block that entire IP network. Be careful with this as there might be legit websites hosted on these ISP's network which blocking would prevent you from accessing.

Another thing I found helpful was in my previous versions of Norton Internet Security, there was a nice tool that allow visual tracking of IP addresses. It brought up a map and showed the originating country/location of the IP address in question. Check out:

http://pcwin.com/Internet/VisualRoute_2007/index.htm

- John
johnhook is offline   Reply With Quote