Security
On my sonicwall, I keep getting messages in my log that state 'Probable port scan dropped'. The source IP Address is my ISPs DNS server. source port is 53, destination ports on my server are 3482, 3482, 3482, 3482, 3485, 3485, 3485, 3485, 3485, 3485, etc.
Why is my ISP scanning me?
by jaqui
when you completely stealth your systems with a firewall, the isp computers start scanning, they know there is a system there, but can't find it.
so they keep scanning trying to find it.
2 options:
1) don't stealth completely
only block at risk ports and non used ports.
2) don't stealth against your isp
allow ping from your isp servers only.
by longennamer
Poster rated this answer.
by zaferus
The source port is DNS UDP, normally used for url to ip resolution. If you are hosting public services it could be trying to resolve something, getting back an unsuccessful response, then trying again on an incremental port. Depending how the ISP's filters are set up; it's also possible someone is using their DNS server to port scan you.
Barring that, I'd contact your ISP and just ask them point blank what their policy is on DNS scans and why they are constantly scanning your WAN IP. They should be able to tell you why it's happening and put the mystery to rest.
Zaf
by longennamer
Poster rated this answer.
by longennamer
This discussion is closed to new replies.
Sort by Trending