RE: Scanning Port UDP 4668

From: Ken Grossman (
Date: 08/06/02

Date: Tue, 06 Aug 2002 11:30:55 -0400
From: "Ken Grossman" <>

I wish to thank every one who provided information and suggested steps to
me. As I stated in the original e-mail message, I was interested in
finding out what the systems were looking for since the scans were being
stopped at the perimeter. The organization that originally brought the
information to my attention believes the following is the source of these

There's a P2P utility called EDonkey that uses UDP 466x and allows any
edonkey user to publish an IP and port of a peer. Apparently, someone
mistyped an IP address; hence the scans.

Again thanks to everyone for their assistance.

Ken Grossman, CISSP
(202) 401-7142

This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: