Login or Register to Ask a Question and Join Our Community


UNIX for Advanced & Expert Users

How to find remote IP addresses that applications are scanning them?

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users How to find remote IP addresses that applications are scanning them?
# 1  
Old 11-10-2014
How to find remote IP addresses that applications are scanning them?
Hi,

I have a web server running on Debian 6.0.4 in a computer outside my university, but the web URL is blocked by my university, the security group of the university said because it was scanning computers inside university.

I could not find any applications in my web server are doing scanning, especially I want to know which IP addresses it is trying to contact to. Is there any simple way to check which applications in my web server are scanning and which IP addresses of the remote machines that my web server is trying to contact to?

Thank you.

- j
# 2  
Old 11-10-2014
Hello hce,

Could you please check you localhost logs I guess there you can easily find out what ever IP address are trying to fetch the URLs hosted by your server.
Kindly let me know if this helps.


Thanks,
R. Singh
# 3  
Old 11-10-2014
Hi hce,
a packet sniffer like tcpdump can tell you what IP addresses your machine is trying to connect to. I do not think that you'll be able to figure out what application is doing the scans (at least not with tcpdump) but it may give you a starting point for further investigations.
# 4  
Old 11-10-2014
A temporary solution might be to write a firewall rule to block all traffic to the university except http/https.
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

How to find the count of IP addresses that belong to different subnets and display the count?

Hi, I have a file with a list of bunch of IP addresses from different VLAN's . I am trying to find the list the number of each vlan occurence in the output Here is how my file looks like 1.1.1.1 1.1.1.2 1.1.1.3 1.1.2.1 1.1.2.2 1.1.3.1 1.1.3.2 1.1.3.3 1.1.3.4 So what I am trying... (2 Replies)
Discussion started by: new2prog
2 Replies

2. Shell Programming and Scripting

Script connect to remote server, not find files and exit only from remote server, but not from scrip

I have a script, which connecting to remote server and first checks, if the files are there by timestamp. If not I want the script exit without error. Below is a code TARFILE=${NAME}.tar TARGZFILE=${NAME}.tar.gz ssh ${DESTSERVNAME} 'cd /export/home/iciprod/download/let/monthly;... (3 Replies)
Discussion started by: digioleg54
3 Replies

3. UNIX for Dummies Questions & Answers

Find applications that use openssl

I have a OpenSSL configured in my RHEL machine. I need to find the list of applications that use or depend on OpenSSL. Is it possible to know which application is using the shared library? ldd `which openssl` linux-gate.so.1 => (0x00b3a000) libssl.so.10 => /usr/lib/libssl.so.10... (5 Replies)
Discussion started by: gowtham.varma
5 Replies

4. Shell Programming and Scripting

Delete characters & find unique IP addresses with port

Hi, I have a file having following content. <sip:9376507346@97.208.31.7:51088 <sip:9907472291@97.208.31.7:51208 <sip:8103742422@97.208.31.7:51024 <sip:9579892841@97.208.31.7:51080 <sip:9370904222@97.208.31.7:51104 <sip:9327665215@97.208.31.7:51104 <sip:9098364262@97.208.31.7:51024... (2 Replies)
Discussion started by: SunilB2011
2 Replies

5. AIX

AIX Remote Connect Fail With “No more multiple IP addresses to connect” Error

We have a production server at a client site running AIX. And recently when users are trying to connect to it via telnet, it prompts "No more multiple IP addresses to connect". Can I know what does this error mean? and how to rectify this? Thanks. (2 Replies)
Discussion started by: a_sim
2 Replies

6. Shell Programming and Scripting

How to find ip addresses in logfiles?

Hi guys, I need to check a few log files as below to find out whether certain ip addresses is present on these log files. type8code0: ls -alt -rw-r--r-- 1 root other 796219588 Mar 20 02:25 logfile drwxr-xr-x 2 root root 1536 Mar 20 02:00 . -rw-r--r-- ... (3 Replies)
Discussion started by: type8code0
3 Replies

7. UNIX for Advanced & Expert Users

find application that are scanning the network

Hi, I got a alert from network security that one of hpux server is running tcp port scan on the network, this server is running informix server and i am not aware of any application that is scanning the network. what are ways to findout the which application and user is doing the scan? (1 Reply)
Discussion started by: robertngo
1 Replies

8. UNIX for Dummies Questions & Answers

error in a remote find

2 AIX servers (AIX 5.3). From local server, I need to manage remote files. But I have some errors with find : # rsh remoteserver find /directory -name filename is OK : I can see the remote file BUT : # rsh remoteserver find /directory -name filename -exec ls -l {} \; fails : I have : find :... (5 Replies)
Discussion started by: annemar
5 Replies

9. IP Networking

find computer names from IP addresses?

Arright, here's what I'm trying to do. I want to dig up currently active IP addresses on my subnet, and my present strategy is to ping every address until I find active ones, then ping them more often to verify their status. Next, I want to find the names of the computers associated with those... (1 Reply)
Discussion started by: sladuuch
1 Replies
Login or Register to Ask a Question