<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=iso-8859-1">
<TITLE>Request for off line security help</TITLE>
<META NAME="GENERATOR" CONTENT="StarOffice/5.2 (Linux)">
<META NAME="CREATED" CONTENT="20011111;17584700">
<META NAME="CHANGEDBY" CONTENT="Ben Beeson">
<META NAME="CHANGED" CONTENT="20011111;18183300">
</HEAD>
<BODY>
<P>Aloha all,</P>
<P> My box was recently scanned by someone. I sent a note to the NOC
that owned the IP address and got a curious reply back. To sum up,
they are systematically scanning folks as part of "network
intelligence." Stated reason is to, "optimize performance
when your customers access the web resources of our customers."
This guy further goes on to say, "Our network was pinging your
system because it appeared to be a name <BR>server with a sufficient
number of resolution requests for our customer web sites to be placed
on the list of network nodes to be constantly observed for Internet
congestion."
</P>
<P> I don't know if I believe this just yet, especially since my system
is just a home computer and port 53 is fire-walled closed... It would
be one thing if the port scan were a cursory check to see where my
system was, but it also appears that the port scan checked for a whole
bunch of stuff. Now, I am not a security whiz... If anyone has a few
minutes and would volunteer to review the log extracts and e-mail I
would be happy to share it. I don't want to make the discussion "too
public" until some one can help me figure out if the proposed
answer from the scanning NOC is believable. Once I know that, I'll
be happy to share my experience in order to "alert the public"
so to speak.
</P>
<P>Thanks in advance,</P>
<P>Ben
</P>
<P> </P>
</BODY>
</HTML>