Re: Lots of incoming traffic on UDP 1026 and UDP 1027?

From: FocusHacks (focushacks_at_gmail.com)
Date: 12/29/04

  • Next message: Jason Bridge: "Re: Recover SCO UNIX root password" 
    Date: Tue, 28 Dec 2004 21:08:17 -0600
To: security-basics@securityfocus.com

    Thanks for the info, guys.

    I never said I was getting DDOS, that was the first replier.

    I guess "hammered" is a pretty strong word. I simply meant that my
    usually quiet firewall self-log has recently gotten quite large, and
    it's not with port scans and HTTP, it's only UDP 1026 and 1027.
    Usually one right after the other from each IP address.

    This is my home ISP running through a NetScreen 5. The only ports
    that are open are 2200 which maps to port 22 on my BSD box for SSH,
    and 21 which maps to the same box for passive FTP.

    I do occasionally open up RDP to a Windows 2000 box for my wife to use
    while she's at work, but only upon request.

    Regardless, my IP address isn't published anywhere for the public to
    use. My wife and I are the only authorized users, so a firewall
    misconfiguration should not cause a nominal amount of unsolicited
    incoming traffic. Most of our outbound traffic is web surfing and
    telnet BBS MUD's. Nothing spectacular.

    A lot of the unsolicited attempts are coming from others on my same
    ISP. Others come from asia and whatnot, which makes sense.

  • Next message: Jason Bridge: "Re: Recover SCO UNIX root password"