[AusNOG] Vyatta PortScanning

[Roland Dobbins]

On Jul 24, 2014, at 5:34 PM, Daniel Watson <Daniel at glovine.com.au> wrote:

> I was wondering how I can stop this within Vyatta as I cannot see anything in our configuration that would be causing this

Vyatta is a software-based router which runs on top of Linux and/or in a VM environment.  If this scanning is originating from the box, that means it's been compromised.

If it's been compromised, then you need to scrub it down to the bare metal, re-install it sitting behind a stateful firewall, patch it, and secure it before you re-install Vyatta and place it outside the stateful firewall to resume its routing duties.

----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

                   Equo ne credite, Teucri.

    		   	  -- Laocoön