I have a slow internet connection - about 12Mb/s. In 10 minutes I have detected a distributed port scan on the router from different IPs. I have counted these SYN packets at in 600 seconds (10 minutes there is a total of 1119 SYN packets).

Why would this happen and what port are they looking for? ICMP packets are dropped as are all SYN packets to all ports. There is a stateful UDP filter for a few other services. What are they looking for? The ASNs come from all over the world.

1 Answer 1


You can safely assume that they are looking for whatever they can find. Port scanning is a step in "Information Gathering" which is one of the attack phases. You can't attack unless you know what there is to hit.

"Excessive" is defined by your normal traffic and how much load your systems can handle. For Google.com, "excessive" is defined very differently from your personal site hosted on a VPS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .