Port 111 scans????

[chimdogger]

Ok I have been scanned on port 27374 for sub seven many times, but lately I have noticed a lot of scans for port 111. Does anybody know what the exploit the "kiddies" are looking for???

ex:
The firewall has blocked Internet access to your computer (TCP Port 111) from 202.214.237.144 (TCP Port 2864) [TCP Flags: S].

Time: 9/6/2001 8:51:38 PM

The firewall has blocked Internet access to your computer (TCP Port 111) from 61.204.29.148 (TCP Port 1146) [TCP Flags: S].

Time: 9/6/2001 8:54:08 PM

The firewall has blocked Internet access to your computer (TCP Port 111) from 65.6.111.98 (TCP Port 4554) [TCP Flags: S].

Time: 9/6/2001 8:56:38 PM

Any feed back is appreciated...

Chimmy:(

[blebs]

Checking for port mapping, but for what reason is beyond me. As long as your firewall is stopping them, rest easy.
2 of those addresses are from Japan with one of them appearing to be a spoof. :)

[greEd]

my guesses are as follows:

c1868920-a.denver1.co.home.com 65.6.111.98 -- looking for a *nix system with rpc

www.hbs-net.ne.jp 61.204.29.148 -- looks like a jp service provider?

http://phoenix.birth.ne.jp/ 202.214.237.144 -- computer has already been rooted. Whoever owns this system is gonna be crying when they learn to never leave a default install of apache on a net side server :eek:

I think a new exploit was found in RPC so more than likely the scripts are beginning to fly ;)

regards,
greEd