RE: [FW1] Port Scanning

[Lance Spitzner <spitzner@dimension.net>]

On Thu, 29 Apr 1999, Bill Lavalette - Operations NdrsNet wrote:


> I agree with Frank. Half the time these scans are initiated the host is 
> comprimised.

Actually, based on two months of research I have been conducting, the
percentage is far smaller then that.  Right now, I would estimate
that only 10% of scans are followed up on (Depending on what they
are scanning for).  Hopefully I will have a more complete report
for the FW community in a couple of more months.  


Lance Spitzner
http://www.enteract.com/~lspitz/papers.html
Internetworking & Security Engineer
Dimension Enterprises Inc



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================