Re: Increase seen in port probes since Tuesday afternoon

From: Martin Mačok (martin.macok_at_underground.cz)
Date: 12/30/04

  • Next message: Michael: "RE: Increase seen in port probes since Tuesday afternoon" 
    Date: Thu, 30 Dec 2004 21:44:30 +0100
To: incidents@securityfocus.com

    On Thu, Dec 30, 2004 at 11:22:51AM +0200, BahdKo wrote:

    > Each probe involves the machine sending three packets to each port.

    Which is default behaviour of Windows boxes - sending three SYN
    packets close after each other even when the destination port is
    reachable and closed (ie. responding with TCP RST).

    Martin Mačok
    IT Security Consultant

  • Next message: Michael: "RE: Increase seen in port probes since Tuesday afternoon"
    • Quantcast