Need Some Help On Ntl Ips Doin A Lot O Scanning

Printable View

Show 40 post(s) from this thread on one page

09-29-2003, 08:35 PM
dingdongding

hey y'all would appreciate anyone with a technical knowledge of how isps operate to take a look at two peerguardian forum threads listed below where peeps talk about gettin a lot of pg hits and scans from ntl isp ranges (most are ntl subscribers themselves but not all)

trying to resolve this ntl issue- essentially whether it's anti p2p (the isp scanning their customers) or not (trojans scannin the hell out of ppl etc)

also specifically how isps log their customer activity (is it done without the use of port scans etc)

any knowledge would be helpful

here be the links

http://www.peerguardian.net/forums/index.p...wtopic=652&st=0

http://www.peerguardian.net/forums/i...?showtopic=372

thanks,

ddd
09-29-2003, 10:02 PM
Sparkle1984

I use NTL as my ISP, and I've never had any problems :) Not that I'm aware of, anyway.
09-29-2003, 10:37 PM
Rat Faced

Probably NTL newsgroups or something.

Without knowing what ports are being scanned, its hard to say...

Strangely its Universal Pictures that appear desperate to get connected to me ;)
09-29-2003, 11:32 PM
$nax

Yeah mate, i have had exactly the same thing, like constantly beatin my firewall, plus tryin to scan every now an then. Someone on here said that they just send out "Packets" or sumthin, just to get information on things like how often u use it an things like that.
Not sure if its nethin to be concerned about. As long as you have youre firewall up they cany see nething newayz so no need to worry.

Do u by nechance have broadband ?
09-29-2003, 11:54 PM
dingdongding

@Rat Faced- which universal ips? curious coz some of the pg entries are old and the arin database has since changed some entries

@$nax- i've heard of isps pinging to test service and also i've heard some firewalls misinterpret isp connections as alert udp packets- but the number of port scans is what is intriguing here (could be trojan who knows)

i'll post back with port numbers, frequencies, times in between etc

i'm not ntl myself and never been hit by them to my knowledge- i'm a us cable customer

trying to get to the bottom of it for the peerguardian database- ntl ranges are in there and one range was recently removed coz some legit users reported they were in the blocked range

any technical input would be welcome (i'll get back with the port info)

thanks,

ddd
10-02-2003, 12:52 AM
dingdongding

ok here's a 1 hour sample:

Quote:

[recent one day log 00:10:43] - In TCP - 81.97.130.98:4555: Rule 'NTL Network Management Centre part3'
[recent one day log 00:10:46] - In TCP - 81.97.130.98:4555: Rule 'NTL Network Management Centre part3'
[recent one day log 00:10:51] - In TCP - 81.97.130.98:4555: Rule 'NTL Network Management Centre part3'
[recent one day log 00:11:24] - In TCP - 81.97.130.98:4644: Rule 'NTL Network Management Centre part3'
[recent one day log 00:11:27] - In TCP - 81.97.130.98:4644: Rule 'NTL Network Management Centre part3'
[recent one day log 00:11:33] - In TCP - 81.97.130.98:4644: Rule 'NTL Network Management Centre part3'
[recent one day log 00:12:03] - In TCP - 81.97.130.98:4697: Rule 'NTL Network Management Centre part3'
[recent one day log 00:12:07] - In TCP - 81.97.130.98:4697: Rule 'NTL Network Management Centre part3'
[recent one day log 00:12:12] - In TCP - 81.97.130.98:4697: Rule 'NTL Network Management Centre part3'
[recent one day log 00:20:17] - In TCP - 81.97.130.98:3236: Rule 'NTL Network Management Centre part3'
[recent one day log 00:20:20] - In TCP - 81.97.130.98:3236: Rule 'NTL Network Management Centre part3'
[recent one day log 00:20:27] - In TCP - 81.97.130.98:3236: Rule 'NTL Network Management Centre part3'
[recent one day log 00:20:58] - In TCP - 81.97.130.98:3313: Rule 'NTL Network Management Centre part3'
[recent one day log 00:21:01] - In TCP - 81.97.130.98:3313: Rule 'NTL Network Management Centre part3'
[recent one day log 00:21:07] - In TCP - 81.97.130.98:3313: Rule 'NTL Network Management Centre part3'
[recent one day log 00:21:40] - In TCP - 81.97.130.98:3404: Rule 'NTL Network Management Centre part3'
[recent one day log 00:21:43] - In TCP - 81.97.130.98:3404: Rule 'NTL Network Management Centre part3'
[recent one day log 00:21:49] - In TCP - 81.97.130.98:3404: Rule 'NTL Network Management Centre part3'
[recent one day log 00:32:08] - In TCP - 81.97.130.98:4169: Rule 'NTL Network Management Centre part3'
[recent one day log 00:32:11] - In TCP - 81.97.130.98:4169: Rule 'NTL Network Management Centre part3'
[recent one day log 00:32:17] - In TCP - 81.97.130.98:4169: Rule 'NTL Network Management Centre part3'
[recent one day log 00:32:52] - In TCP - 81.97.130.98:4254: Rule 'NTL Network Management Centre part3'
[recent one day log 00:32:55] - In TCP - 81.97.130.98:4254: Rule 'NTL Network Management Centre part3'
[recent one day log 00:33:01] - In TCP - 81.97.130.98:4254: Rule 'NTL Network Management Centre part3'
[recent one day log 00:33:33] - In TCP - 81.97.130.98:4309: Rule 'NTL Network Management Centre part3'
[recent one day log 00:33:35] - In TCP - 81.97.130.98:4309: Rule 'NTL Network Management Centre part3'
[recent one day log 00:33:41] - In TCP - 81.97.130.98:4309: Rule 'NTL Network Management Centre part3'
[recent one day log 00:46:36] - In TCP - 81.97.130.98:3312: Rule 'NTL Network Management Centre part3'
[recent one day log 00:46:39] - In TCP - 81.97.130.98:3312: Rule 'NTL Network Management Centre part3'
[recent one day log 00:46:45] - In TCP - 81.97.130.98:3312: Rule 'NTL Network Management Centre part3'
[recent one day log 00:47:18] - In TCP - 81.97.130.98:3397: Rule 'NTL Network Management Centre part3'
[recent one day log 00:47:20] - In TCP - 81.97.130.98:3397: Rule 'NTL Network Management Centre part3'
[recent one day log 00:47:27] - In TCP - 81.97.130.98:3397: Rule 'NTL Network Management Centre part3'
[recent one day log 00:47:58] - In TCP - 81.97.130.98:3430: Rule 'NTL Network Management Centre part3'
[recent one day log 00:48:01] - In TCP - 81.97.130.98:3430: Rule 'NTL Network Management Centre part3'
[recent one day log 00:48:07] - In TCP - 81.97.130.98:3430: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:05] - In TCP - 81.97.130.98:3711: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:08] - In TCP - 81.97.130.98:3711: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:14] - In TCP - 81.97.130.98:3711: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:50] - In TCP - 81.97.130.98:3759: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:52] - In TCP - 81.97.130.98:3759: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:58] - In TCP - 81.97.130.98:3759: Rule 'NTL Network Management Centre part3'
[recent one day log 00:54:30] - In TCP - 81.97.130.98:3784: Rule 'NTL Network Management Centre part3'
[recent one day log 00:54:33] - In TCP - 81.97.130.98:3784: Rule 'NTL Network Management Centre part3'
[recent one day log 00:54:39] - In TCP - 81.97.130.98:3784: Rule 'NTL Network Management Centre part3'
10-02-2003, 01:24 AM
dingdongding

also here are the biggest "offenders" (from across a group of 5 or so ppl)

81.97.28.229
81.97.34.16
81.97.37.100
81.97.58.31
81.97.64.140
81.97.67.51
81.97.68.73
81.97.70.183
81.97.110.238
81.97.130.98
81.97.134.128
81.97.144.13
81.97.148.191
81.97.149.71
81.97.151.60
81.97.167.23
81.100.90.3
81.100.91.193
81.100.94.94
81.100.94.236
81.100.129.74
81.109.103.7
81.109.104.91
10-02-2003, 07:20 PM
$nax

Pretty much the same here.

Have you used Arin/ whois to find the exact location of the IP. The one that hits me is the NTL Management Centre, Crawley, also the NTL IP Block, Crawley.
10-02-2003, 07:37 PM
dingdongding

do the locations really matter? i know some ppl might have thought if it said ntl management centre that they automatically assumed it was the isp scanning them when in fact ntl management centre is listed on almost every ntl whois- at some part of the whois

i dunno i'm not an ntl subscriber

if anyone has other ips slamming them please post them

thanks,

ddd
10-07-2003, 09:18 PM
dingdongding

Quote:

Originally posted by dingdongding@1 October 2003 - 20:52
ok here's a 1 hour sample:

Quote:

[recent one day log 00:10:43] - In TCP - 81.97.130.98:4555: Rule 'NTL Network Management Centre part3'
[recent one day log 00:10:46] - In TCP - 81.97.130.98:4555: Rule 'NTL Network Management Centre part3'
[recent one day log 00:10:51] - In TCP - 81.97.130.98:4555: Rule 'NTL Network Management Centre part3'
[recent one day log 00:11:24] - In TCP - 81.97.130.98:4644: Rule 'NTL Network Management Centre part3'
[recent one day log 00:11:27] - In TCP - 81.97.130.98:4644: Rule 'NTL Network Management Centre part3'
[recent one day log 00:11:33] - In TCP - 81.97.130.98:4644: Rule 'NTL Network Management Centre part3'
[recent one day log 00:12:03] - In TCP - 81.97.130.98:4697: Rule 'NTL Network Management Centre part3'
[recent one day log 00:12:07] - In TCP - 81.97.130.98:4697: Rule 'NTL Network Management Centre part3'
[recent one day log 00:12:12] - In TCP - 81.97.130.98:4697: Rule 'NTL Network Management Centre part3'
[recent one day log 00:20:17] - In TCP - 81.97.130.98:3236: Rule 'NTL Network Management Centre part3'
[recent one day log 00:20:20] - In TCP - 81.97.130.98:3236: Rule 'NTL Network Management Centre part3'
[recent one day log 00:20:27] - In TCP - 81.97.130.98:3236: Rule 'NTL Network Management Centre part3'
[recent one day log 00:20:58] - In TCP - 81.97.130.98:3313: Rule 'NTL Network Management Centre part3'
[recent one day log 00:21:01] - In TCP - 81.97.130.98:3313: Rule 'NTL Network Management Centre part3'
[recent one day log 00:21:07] - In TCP - 81.97.130.98:3313: Rule 'NTL Network Management Centre part3'
[recent one day log 00:21:40] - In TCP - 81.97.130.98:3404: Rule 'NTL Network Management Centre part3'
[recent one day log 00:21:43] - In TCP - 81.97.130.98:3404: Rule 'NTL Network Management Centre part3'
[recent one day log 00:21:49] - In TCP - 81.97.130.98:3404: Rule 'NTL Network Management Centre part3'
[recent one day log 00:32:08] - In TCP - 81.97.130.98:4169: Rule 'NTL Network Management Centre part3'
[recent one day log 00:32:11] - In TCP - 81.97.130.98:4169: Rule 'NTL Network Management Centre part3'
[recent one day log 00:32:17] - In TCP - 81.97.130.98:4169: Rule 'NTL Network Management Centre part3'
[recent one day log 00:32:52] - In TCP - 81.97.130.98:4254: Rule 'NTL Network Management Centre part3'
[recent one day log 00:32:55] - In TCP - 81.97.130.98:4254: Rule 'NTL Network Management Centre part3'
[recent one day log 00:33:01] - In TCP - 81.97.130.98:4254: Rule 'NTL Network Management Centre part3'
[recent one day log 00:33:33] - In TCP - 81.97.130.98:4309: Rule 'NTL Network Management Centre part3'
[recent one day log 00:33:35] - In TCP - 81.97.130.98:4309: Rule 'NTL Network Management Centre part3'
[recent one day log 00:33:41] - In TCP - 81.97.130.98:4309: Rule 'NTL Network Management Centre part3'
[recent one day log 00:46:36] - In TCP - 81.97.130.98:3312: Rule 'NTL Network Management Centre part3'
[recent one day log 00:46:39] - In TCP - 81.97.130.98:3312: Rule 'NTL Network Management Centre part3'
[recent one day log 00:46:45] - In TCP - 81.97.130.98:3312: Rule 'NTL Network Management Centre part3'
[recent one day log 00:47:18] - In TCP - 81.97.130.98:3397: Rule 'NTL Network Management Centre part3'
[recent one day log 00:47:20] - In TCP - 81.97.130.98:3397: Rule 'NTL Network Management Centre part3'
[recent one day log 00:47:27] - In TCP - 81.97.130.98:3397: Rule 'NTL Network Management Centre part3'
[recent one day log 00:47:58] - In TCP - 81.97.130.98:3430: Rule 'NTL Network Management Centre part3'
[recent one day log 00:48:01] - In TCP - 81.97.130.98:3430: Rule 'NTL Network Management Centre part3'
[recent one day log 00:48:07] - In TCP - 81.97.130.98:3430: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:05] - In TCP - 81.97.130.98:3711: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:08] - In TCP - 81.97.130.98:3711: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:14] - In TCP - 81.97.130.98:3711: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:50] - In TCP - 81.97.130.98:3759: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:52] - In TCP - 81.97.130.98:3759: Rule 'NTL Network Management Centre part3'
[recent one day log 00:53:58] - In TCP - 81.97.130.98:3759: Rule 'NTL Network Management Centre part3'
[recent one day log 00:54:30] - In TCP - 81.97.130.98:3784: Rule 'NTL Network Management Centre part3'
[recent one day log 00:54:33] - In TCP - 81.97.130.98:3784: Rule 'NTL Network Management Centre part3'
[recent one day log 00:54:39] - In TCP - 81.97.130.98:3784: Rule 'NTL Network Management Centre part3'

was hopin to get some technical insight into port info like this

Show 40 post(s) from this thread on one page