Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
RE: UDP Port Sweep question
From: Benjamin Franz (snowharenihongo.org)
Date: Wed Dec 29 2004 - 14:11:21 CST
On Wed, 29 Dec 2004, Billy Dodson wrote:
> Here is some more info regarding the port sweeps. The port the client
> is being hit on seems to vary. The client is being hit on the same 8
> port range from each IP port 33434-33460. All 3 sensors from the 3
> different clients show the same destination port range. The sensors are
> cisco IDS sensors and I am unsure as to how to get the actual packet
> from the event.
That port range smells like traceroutes. I've seen a lot of that kind of
traffic to nameservers, mail servers and HTTP proxies. It often originates
from load balancing DNS systems and other such things.
"All right, where is the answer? The battle of wits has begun.
It ends when you click and we both serve pages - and find out who is right,
and who is slashdotted." - David Brandt