Re: [fw-wiz] Scans on UDP 38072

-----Original Message-----
Subject: [fw-wiz] Scans on UDP 38072

Recently I've noticed today quite a few denied connections for UDP/38072
and occasionally for TCP/38072
on two different firewalls. I've searched for some information on this
protocol but I couldn't find
anything relevant. Most of the connections come from dynamically assigned
IP addresses. For some IPs
there are several connection attempts, each 1 min. 25 seconds apart. Did
anyone see this kind of traffic
in their logs?

More RPC / Windows Messenger scanning/spamming.

http://www.dshield.org/port_report.php?port=38072


PaulM


_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: MAPI vs IMAP4
    ... uses RPC over HTTP.... ... Service Provider Interface -+ ... Server Server Modem Server Server ... That's a protocol question, not a client question. ...
    (microsoft.public.exchange.admin)
  • MSBLAST virus portable to Linux?
    ... Since the MSBLAST virus uses an exploit in Windows RPC which is drived from ... they might have *borrowed* some OSF code? ... Remote Procedure Call (RPC) is a protocol used by the Windows ...
    (comp.os.linux.misc)
  • Re: ISA 2004 RPC over HTTPS
    ... RPC over HTTPS nutze? ... Wenn ich die beiden IPs bei DNS ...
    (microsoft.public.de.german.isaserver)
  • Re: RPC Binding
    ... The RPC Bindings that a server offers is dependant on the rpc ... ClientProtocols registry subkey contains entries that determine the ... registry subkey determines if the operating system supports that protocol. ...
    (microsoft.public.exchange.connectivity)
  • Re: MSBLAST virus portable to Linux?
    ... they might have *borrowed* some OSF code? ... ]"> Remote Procedure Call (RPC) is a protocol used by the Windows ... ]"> is derived from the OSF (Open Software Foundation) RPC protocol, ...
    (comp.os.linux.misc)