yejun wrote:
The log file looks like this
Code:
IN= OUT=eth0 SRC=67.18.*.*DST=140.211.*.* LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=1362 DF PROTO=TCP SPT=39659 DPT=80 WINDOW=126 RES=0x00 ACK FIN URGP=0
It looks like a Maimon scan. Is the source IP known to you?
From the nmap man page:
Quote:
-sM (TCP Maimon scan)
The Maimon scan is named after its discoverer, Uriel Maimon. He
described the technique in Phrack Magazine issue #49 (November
1996). Nmap, which included this technique, was released two issues
later. This technique is exactly the same as null, FIN, and Xmas
scans, except that the probe is FIN/ACK. According to RFC 793
(TCP), a RST packet should be generated in response to such a probe
whether the port is open or closed. However, Uriel noticed that
many BSD-derived systems simply drop the packet if the port is
open.
It seems to be common to get all kinds of scans from just about everywhere on any internet IP.