[newhouse1390]

Pulled this from the routers logs. What do I do?

Dec 24 17:04:19 Xmas port scan attack from WAN (ip detected.
Dec 24 16:58:58 SYN-ACK port scan attack from WAN (ip:67.15.121.40) detected.
Dec 24 16:56:55 Xmas port scan attack from WAN (ip detected.
Dec 24 16:56:19 Xmas port scan attack from WAN (ip detected.
Dec 24 16:53:07 Xmas port scan attack from WAN (ip detected.
Dec 24 16:51:31 Xmas port scan attack from WAN (ip detected.
Dec 24 16:50:55 Xmas port scan attack from WAN (ip detected.
Dec 24 16:50:31 Xmas port scan attack from WAN (ip detected.
Dec 24 16:48:31 Xmas port scan attack from WAN (ip detected.
Dec 24 16:41:55 Xmas port scan attack from WAN (ip detected.

 

[johnwill]

Nothing. It's just one of the many scans by the script kiddies out in Internet Land. The ones you have to worry about are the ones that don't make it to the log! :grin:

 

[KezzeR]

Port scans are nothing to worry about as long as you have a firewall up, and all of your open ports and in use.

 

[newhouse1390]

The router on the firewall is active, should I consider blocking the WAN IP address from which the scans are originating?

 

[johnwill]

Don't bother, you'll be blocking addresses the rest of your life! :grin: It's pointless, because the scans come from all over the place. What you really risk doing is blocking an address that later you need to access. Also, the address table for blocked addresses in most routers is pretty small, you'll run out of space long before the script kiddies run out of IP addresses. :smile: