Re: Another odd scan...

From: Jose Nazario (
Date: 07/13/02

Date: Fri, 12 Jul 2002 18:23:17 -0400 (EDT)
From: Jose Nazario <>
To: Adam Young <>

On Thu, 11 Jul 2002, Adam Young wrote:

> I got this for about 2 minutes, every 20 seconds or so, I just
> thought it especially weird with "CWR ECE SYN", looking as to what the
> meaning of this is.

ECE: explicit congestion echo
CWR: RFC2481 says "congestion window reduced"

here's a whois dig for that:

as for the port (77/TCP) being connected to, the saint tutorial suggests
its a well known and used backdoor for the rpc.yppasswdd service on

hope that helps.

jose nazario, ph.d.

This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: