I get constantly port scanned (every 5 mins or so) and the port scans ALWAYS originate from an IP address that starts with 211.27. does this mean anything? The last port scan that occurred was from 211.27.14.10 when i do a backtrace I dont know how to make heads or tails from the information supplied can someone explain for me? Thanks

canonical name 10.b.001.nlt.iprimus.net.au. Is your ISP PRIMUS (or an affiliate)? Your email is an Aussie one, so that seems likely. I'm no expert, but scans originating from your ISP are not uncommon, and seem to be a 'normal' part of being online. Perhaps someone can explain more fully. I'm just looking for clues at the scene of the crime

if your firewall stops it, just ignore it. your ISP does not scan you, those are addresses the ISP rents to customers.

Thanks for the clarification. I suppose there's always the Sam Spade POV I'm just looking for clues at the scene of the crime

Normally these repeat scans like that from within your own ISP's network are coming from some customers machine that is infected with a worm or trojan that is trying to spread. This is why I prefer a good hardware firewall instead of a software one. The hardware firewall just blocks the access and my system does not have to spend overhead dealing with the hits or logging them to a disk file. Your ISP is not going to tell you who's system it is. They might do something if you send a notice to them about it (they might just recommend some firewall software), but if they really cared about that type of problem, they would be tracking infected users down (they have the tools and information) and having them fix their systems.

Cool, thanks guys for the responses.