Re: UDP port 500 traffic from two clients

From: Gary Flynn (flynngn@jmu.edu)
Date: 01/28/02 

Date: Mon, 28 Jan 2002 14:33:16 -0500
From: Gary Flynn <flynngn@jmu.edu>
To: Chris Wilkes <cwilkes@ladro.com>

Chris Wilkes wrote:
>
> I recently moved and changed IP addresses within my ISP's block and two
> IP addresses from mediaone.net and home.com hit me a couple of times a
> minute with a UDP request to port 500.

Code Red and Nimda infected machines will reportedly generate port
500 traffic. 

-- 
Gary Flynn
Security Engineer - Technical Services
James Madison University

Please R.U.N.S.A.F.E.
http://www.jmu.edu/computing/runsafe

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • RE: Can not print (print server is Win2000 machine)
    ... Hit the offline button ... Standard Port Monitor ... Click Start, point to Settings, and then click Printers. ... Click Standard TCP/IP Port, ...
    (microsoft.public.win2000.general)
  • Linksys Cable/DSL router Port Forwarding
    ... I have a web server running on the static IP for testing ... LAN using the internal IP and/or I want to hit it using the external IP ... I have internet access on all three machines. ... I have opened port 8090 in port forwarding for the static IP that the NT 4 ...
    (comp.security.firewalls)
  • Re: Git via a proxy server?
    ... Doesn't even appear to hit the proxy server. ... MIS had opened up the port ... Try using the HTTP protocol. ...
    (Linux-Kernel)
  • re: Syn packets hitting port 80, not webserver
    ... Syn packets hitting port 80, ... Most hit twice ... Listen to your Yahoo! ...
    (Incidents)
  • Re: Questions about "net" messenger service (NOT MSN Messenger)
    ... >Sorry for being so the redundant question, but port 135 is used by the ... loophole in the messenger service and hence display adverts. ... malicious programs can get through to hit other loopholes - this is how ... fix was available three weeks before BLAST hit) - but there may be other ...
    (microsoft.public.windowsxp.general)