RE: Detecting Network scans

Steve,

Check out http://www.xs4all.nl/~hgj/ipflt/

That shows how to log every incoming TCP/IP connect request to your AS/400.
It works great!

I'll say one thing. Port 135 sure is popular. My AS/400 doesn't listen on
that port, but I sure get a lot of people trying to hit it!

Good luck!
Richard


-----Original Message-----
From: security400-bounces@xxxxxxxxxxxx
[mailto:security400-bounces@xxxxxxxxxxxx]On Behalf Of Steve McKay
Sent: Wednesday, November 05, 2003 1:43 PM
To: security400@xxxxxxxxxxxx
Subject: [Security400] Detecting Network scans


All -

Is there something (exit program, setting, etc.) which would/could alert me
if my iSeries is being scanned from a specific subnet or IP address?  Or if
a connection request came from outside *my* subnet? (3rd party software is
probably not a viable solution but I'd be willing to consider it.)

Thanks,

Steve