Port Scan(?)
From: Adrian Horton (adhort02@yahoo.com)Date: 03/20/02
- Previous message: dewt: "Re: A question about logon banners"
- Next in thread: jklemenc@fnal.gov: "Re: Port Scan(?)"
- Reply: jklemenc@fnal.gov: "Re: Port Scan(?)"
- Reply: leon: "RE: Port Scan(?)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 20 Mar 2002 11:41:33 -0800 (PST) From: Adrian Horton <adhort02@yahoo.com> To: security-basics@securityfocus.com
The incidents@securityfocus.com owner rejected this
post so can anyone here make sense of this?
On my 10.1.2.0/24 network, I discovered (with
Ethereal) that one of my hosts (10.1.2.112) was
broadcasting UDP packets to 255.255.255.255 to port
62516.
The *source port* though was incrementing by one after
every packet. That host machine is running Windows
2000.
Anyone know what kind of activity this is? It seems
the opposite of a port scan and it is inside my
private network. I know which machine it is, I just
can't figure out what it was doing so I disconnected
it from the network until I figure it out.
Thanks,
AH
__________________________________________________
Do You Yahoo!?
Yahoo! Sports - live college hoops coverage
http://sports.yahoo.com/
- Previous message: dewt: "Re: A question about logon banners"
- Next in thread: jklemenc@fnal.gov: "Re: Port Scan(?)"
- Reply: jklemenc@fnal.gov: "Re: Port Scan(?)"
- Reply: leon: "RE: Port Scan(?)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
