ISP Repeatedly Scanning my Ports..

[Staind]

Hi, I recently installed Sygate personal firewall, and I noticed that my ISP scans the following ports 3127, 6129, 139, 2745 and 445 roughly 20 times today (I did an IP trace turns it was my ISP). I'm just curious about why they would do this and if it's normal.  I'm thinking about calling them and asking.

Thanks,
-Staind.

[Eddy]

It doesn't have to be your provider. It can also be other people who are using the same provider.

[Staind]

Maybe, the IP is:

Bell Canada BELLNEXXIA-10 (NET-65-92-0-0-1)
                                  65.92.0.0 - 65.95.255.255
Bell Nexxia (High Speed) HSKITCH-CA (NET-65-93-96-0-1)
                                  65.93.96.0 - 65.93.159.255

=> note, the scans seem to now be every 10 seconds, then they stop for about 10 mins.

[softwareguy]

I also would think the same...
People using the same ISP as you and doing port scans around your ISP's assigned IP range.

[neal62]

I work for an ISP. We do not scan our customers pcs. There is no reason for us to do that. I would think it's being done by someone else as the others have mentioned to you.

[Staind]

After I restarted it appeared to stop. I did a google search on it and found about 5 other people who've had the same problem (supposedly Bell Sympatico my ISP scanning their ports!)  I think it is my ISP and I'm going to call them tomorrow.

Thanks for your suggestions,
-Staind.

[DavidR]

I get the occasional scan from my ISP (dial-up connection), these are all blocked by my firewall Outpost.

I have pretty much identified that these are more to do with checking a connection is not idle, rather than something more sinister.

[Staind]

I get the occasional scan from my ISP (dial-up connection), these are all blocked by my firewall Outpost.

I have pretty much identified that these are more to do with checking a connection is not idle, rather than something more sinister.

Yea, but last night these scans began to occur every 10 seconds. They stopped after restart though and I haven't had one all day.

[Eddy]

Just a thought I have.... But do you have a static or a dynamic IP address?

[Staind]

Dynamic.

[Eddy]

That can explain the difference in being "scanned" often or not. And it is definatly a indication that it is not your ISP doing this. eg the sasser worm is trying to spread itself to ip-addresses which are:
50% are completely random
25% have the same first octet as the IP address of the infected host
25% have the same first and second octet as the IP address of the infected host.

Since your IP changes everytime, you also will see different amounts of "scanning"

[techie101]

One feature of Sygate that is not published is the ability to stop all active responses from your computer......which effectively makes it "dead" to the scanning computer.

Open up the Sygate Security log, highlight the traffic line and right click.  Choose Stop active responses.

The scans should stop for the session.

I have the same trouble with ATT.

Good luck

[Lisandro]

One feature of Sygate that is not published is the ability to stop all active responses from your computer......which effectively makes it "dead" to the scanning computer.

Techie, can we configure Agnitum Outpost for that?  
Is pk reading this forum?  

[bob3160]

Techie
And ZA also???

[Staind]

Scans have totally stopped (for 2 days). This is a little weird, one day of constant port scans then nothing..?