How can we locate malicious port-scanner on server?

J

jols

Well-Known Member
Mar 13, 2004
1,110
3
168
Just received this via email today:

"This IP address, xxx.xx.x.xx (our server IP went here), is constantly doing port scans and trying to get into my firewall. Please resolve this matter ASAP."

I assume this is due to some goofball uploading a malicious port-scanner, probably written in binary, probably in a hidden directory, etc.

Question - How can we look for this? Netstat? (I know very little about how to use Netstat.)

By the way, I just ran the latest version of rkhunter and everything looks good there.

Thanks for any response.
 
You must log in or register to reply here.
Thread starter Similar threads Forum Replies Date
L [jailed shell]mmap() failed: [12] Cannot allocate memory General Discussion 8
E SOLVED module installer cannot install memcached due to failure to locate libmemcached despite it being installed General Discussion 1
B Locate backup on secondary disk General Discussion 1
B Error: The system cannot locate a site with the requested unique identifier. General Discussion 1
M CRON Error Cannot allocate memory General Discussion 7
Similar threads
[jailed shell]mmap() failed: [12] Cannot allocate memory
SOLVED module installer cannot install memcached due to failure to locate libmemcached despite it being installed
Locate backup on secondary disk
Error: The system cannot locate a site with the requested unique identifier.
CRON Error Cannot allocate memory
Top Bottom