I have a lot of XMAS/NULL/SYN packets (+-1000 packets/day/server) from same IPs (+-120 differents IPs from anywhere) on multiple servers. Logs and firewalls are checked daily and servers are updated.

Do I have something to do with those ips (e.g. nslookup, whois, complain to ip owners) ?

Something else to do ?

Thanks in advance

  • 2
    I'm not really sure what you're asking here. Can you please clarify what you want to do? – RoraΖ Oct 7 '14 at 11:45
  • I hope it's better ;-) – hotips Oct 7 '14 at 12:10

As GdD pointed out, these are just typical scanning activities that occur on a daily basis for servers that are connected to the internet. Similar to what you have observed, I have seen a recent surge in X-Mas scans from a large number of IP addresses, probably because it's near the festive season.

The first thing to do is to recognize what the attacker can find out from these scanning. The objective of TCP/UDP scanning is to map out all ports that are open on the server and determine what kind of OS your server is likely to be using. Further reconnaissance may be conducted to determine what services are running behind those open ports.

Normally, tools like Nmap or Nessus would be used to probe your server for open ports. These tools rely on your server responding to them to find out if a port is:

  • open
  • closed
  • filtered

If your server is using an out-of-the-box firewall configuration, then more likely than not, it will be compliant to RFC 793. Scanners rely on firewalls to respond in a predictable manner to find out if a port is open or closed. If your firewall is non-compliant, i.e. network packets are dropped when they should be rejected, or vice-versa, then the scanners would get confused and probably give a wrong report.

Depending on the level of skills, your attacker may mask his IP address by deploying decoys or by scanning indirectly with zombies. Though I hope there would be fewer cowards out there who scan bravely because there is really nothing to fear helping people check if their door is locked, it is quite a futile attempt to root out the perpetrators and most people would not even bother.


This is typical low-level scanning, it's not uncommon for servers to see hundreds or thousands of scanning attempts per day.

You are not required to notify anyone, in fact the majority of people and companies out there take no action, they just accept being scanned as part of connecting to the internet.

You could notify the email address listed as maintainer in the whois entry for the IP block that you are receiving scan traffic, who knows, they may even fix it. I wouldn't hold my breath though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.