I have a slow internet connection - about 12Mb/s. In 10 minutes I have detected a distributed port scan on the router from different IPs. I have counted these SYN packets at in 600 seconds (10 minutes there is a total of 1119 SYN packets).

Why would this happen and what port are they looking for? ICMP packets are dropped as are all SYN packets to all ports. There is a stateful UDP filter for a few other services. What are they looking for? The ASNs come from all over the world.


You can safely assume that they are looking for whatever they can find. Port scanning is a step in "Information Gathering" which is one of the attack phases. You can't attack unless you know what there is to hit.

"Excessive" is defined by your normal traffic and how much load your systems can handle. For Google.com, "excessive" is defined very differently from your personal site hosted on a VPS.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.