RE: Scanning Port UDP 4668

From: Ken Grossman (kgrossman@dazzling.com)
Date: 08/06/02


Date: Tue, 06 Aug 2002 11:30:55 -0400
To: incidents@securityfocus.com
From: "Ken Grossman" <kgrossman@dazzling.com>

I wish to thank every one who provided information and suggested steps to
me. As I stated in the original e-mail message, I was interested in
finding out what the systems were looking for since the scans were being
stopped at the perimeter. The organization that originally brought the
information to my attention believes the following is the source of these
scans.

There's a P2P utility called EDonkey that uses UDP 466x and allows any
edonkey user to publish an IP and port of a peer. Apparently, someone
mistyped an IP address; hence the scans.

Again thanks to everyone for their assistance.

Ken Grossman, CISSP
kgrossman@dazzling.com
(202) 401-7142

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com