2013-10-06
IPv6 is growing up: I'm seeing a portsca ...
IPv6 is growing up: I'm seeing a portscan in my logs from an IPv6 address!SRC=2001:0da8:0001:fffe:0000:0000:0000:0108 DST=2001:0980:14ca:0042:0000:0000:0000:0018 LEN=64 TC=0 HOPLIMIT=242 FLOWLBL=0 PROTO=TCP SPT=52537 DPT=110 WINDOW=1024 RES=0x00 SYN URGP=0 SRC=2001:0da8:0001:fffe:0000:0000:0000:0108 DST=2001:0980:14ca:0042:0000:0000:0000:0018 LEN=64 TC=0 HOPLIMIT=242 FLOWLBL=0 PROTO=TCP SPT=52537 DPT=135 WINDOW=1024 RES=0x00 SYN URGP=0 SRC=2001:0da8:0001:fffe:0000:0000:0000:0108 DST=2001:0980:14ca:0042:0000:0000:0000:0018 LEN=348 TC=0 HOPLIMIT=38 FLOWLBL=74565 PROTO=UDP SPT=57528 DPT=40408 LEN=308 sshd[5410]: Did not receive identification string from 2001:da8:1:fffe::108Interesting source address:inet6num: 2001:0DA8:0000::/40 netname: CER2BKB6-CERNET2 descr: ~{9z<RMxBgVPPD~} descr: CERNET2 Backbone Connection and Test Block descr: Beijing 100084, ChinaThe scans were limited to 2 IPv6 addresses related to published services.