topic Re: Nmap UDP Port Sweep in Network Security

Nmap UDP Port Sweep

sagittarius — Sun, 10 Mar 2019 10:39:45 GMT

Hi,

We are getting some events on IPS for Nmap UDP Port Sweep (Signature - 4003). Attacker shows an external address, what can I do for this alert, what actions can I take?

Re: Nmap UDP Port Sweep

mhellman — Mon, 18 Jun 2007 21:26:15 GMT

Generally, even if it's legitimate it's not something to worry about. More than likely though, it's just return traffic. Please provide the source and destination ports.

Re: Nmap UDP Port Sweep

sagittarius — Tue, 19 Jun 2007 16:40:58 GMT

Destination Port # changes from udp/356,357,358,361,367,359,500 however the attacker port remains the same (500 or 137)

Re: Nmap UDP Port Sweep

mhellman — Tue, 19 Jun 2007 16:50:35 GMT

udp 500 and 137 are both well known udp ports (isakmp and netbios-ns), so there's a good chance this is udp reply traffic to a know port. Are the source IP addresses internal? Are the destination IP addresses internal?

Re: Nmap UDP Port Sweep

sagittarius — Tue, 19 Jun 2007 17:09:03 GMT

yes source IP is internal and destination is external.

Re: Nmap UDP Port Sweep

mhellman — Tue, 19 Jun 2007 17:16:17 GMT

I've confused myself. to clarify:

SOURCE IP:PORT = :356,357,500,etc

DESTINATION IP:PORT = :137,500

Is that right?

Re: Nmap UDP Port Sweep

sagittarius — Tue, 19 Jun 2007 17:34:35 GMT

No,

Source Port :: 137,500

Destination Port: : 356,357,500

Re: Nmap UDP Port Sweep

mhellman — Tue, 19 Jun 2007 17:42:47 GMT

I guess I'm missing something. attacker = source ip unless "swap attacker victim" is selected, which it isn't by default for this sig.