Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I received an email from a client with IDS logs. I was wondering if the following log has any real indications of the server being compromised. If there are certain things I can do to diagnose the situation I am open for any suggestions.

###Log Start##
02/28/2011 08:58:42.352 - Alert - Intrusion Prevention - Possible port scan
detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 8897, OPT - TCP scanned
port list, 8869, 8867, 8863, 8898, 8899
02/28/2011 09:08:01.144 - Alert - Intrusion Prevention - Possible port scan
detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 12470, OPT - TCP scanned
port list, 12403, 12454, 12462, 12466, 12472
02/28/2011 09:09:20.080 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 14037, OPT - TCP
scanned port list, 13972, 13970, 14023, 13979, 13983
02/28/2011 09:10:58.496 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 15749, OPT - TCP
scanned port list, 15755, 15715, 15697, 15717, 15751
02/28/2011 09:14:24.112 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 19277, OPT - TCP
scanned port list, 19239, 19266, 19269, 19273, 19275
02/28/2011 09:15:50.592 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 21033, OPT - TCP
scanned port list, 21071, 20965, 21111, 20955, 21090
02/28/2011 09:26:15.016 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 37244, OPT - TCP
scanned port list, 37260, 37278, 37235, 37238, 37247
02/28/2011 09:28:53.592 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 40411, OPT - TCP
scanned port list, 40468, 40453, 40454, 40455, 40465
02/28/2011 09:29:19.128 - Alert - Intrusion Prevention - Possible port scan
detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 41163, OPT - TCP scanned
port list, 41217, 41216, 41178, 41137, 41138
02/28/2011 09:40:38.240 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 55567, OPT - TCP
scanned port list, 55555, 55553, 55582, 55589, 55561
###Log End##
share|improve this question
    
Can you give us any info about if there were common IPs from which the scans originated from? The x.x.x.x (why are there 5 x's in your example?) would be more helpful if we knew at least about some of the associations of the IPs.. –  mrnap Mar 3 '11 at 5:32
add comment

migrated from serverfault.com Feb 28 '11 at 19:25

This question came from our site for professional system and network administrators.

1 Answer

There are no indications of a compromise in the logs. They only show at worst port scanning. This is the act of looking for open ports, the next stage if open ports were found would be to check the version of software running and then to try to exploit potential vulnerabilities to gain access. This would show up in the logs as well (as long as the IDS has not been incorrectly tuned).

However, it would be worth looking at the web server logs to see if the source address of this activity corresponds to a valid IP using the web server. Sometimes when clients try to connect to a service they make a connection on the remote port (in this case 443) and the server attempts to open up a high port for the return traffic. If this is blocked the connection may try to establish a different high port and so on. This can have the effect of looking like a port scan.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.