[fw-wiz] TCP 4885 to 0's broadcast address

From: epperson@vak12ed.edu
Date: 11/14/02 

To: firewall-wizards@honor.icsalabs.com
From: <epperson@vak12ed.edu>
Date: Thu Nov 14 17:42:43 2002

We're seeing traffic targeting the 0's broadcast address on one of our
subnets (e.g. 10.1.1.0) mostly with a dest port of UDP 4885 (a few are bound
for TCP 4881). Sources tend to be a stream of various addresses within a
16-bit prefix, then it switches to another 16-bit prefix. Have not been able
to identify this pattern as to intent, although we're picking them off.

Does anyone recognize this footprint?

regards,
j.

Relevant Pages

  • Re: Remove namespace from in-/outgoing instance
    ... I can't believe there isn't a better way to add a prefix to a xml document, ... worked by adding a namespace to the incoming doc. ... message (presented as a stream by BizTalk). ...
    (microsoft.public.biztalk.general)
  • Re: Sys::Syslog under Solaris
    ... > 'stream', I don't get anything logged, and if I log via udp instead, ... Or to get rid of the prefix? ... # grouped with other variable settings ...
    (comp.lang.perl.misc)
  • Re: tcllib, dns package, the 16bit size prefix in TCP
    ... TCP is stream oriented: no boundaries are guaranteed to go through. ... etc) include an extra prefix giving the length of the data unit. ... prepends this size bytes and it works correctly, BIND server still ...
    (comp.lang.tcl)
  • std::ostream manipulator
    ... Is it possible to manipulate the std::ostream to prepend a string when ... // results in "prefix hallo" ... // remove prefix '\t' from stream ... when MyClass has a pointer to another MyClass as a member ...
    (comp.lang.cpp)
  • Creating a Custom Send Pipeline Component
    ... Biztalk puts ns0 as the default prefix to the generated xml message. ... and outputs the modified stream. ... have never created a custom component. ...
    (microsoft.public.biztalk.general)