[Intrusions] Port Scanning on 1026 & 1027

[Merton Campbell Crockett]

On Tue, 26 Jul 2005, Tony Tomasello wrote:

> I have noticed a tremendous amount of scanning on ports 1026 and 1027. Not 
> sure if you all have been experiencing the same. Is this something that I 
> should be concerned about ?

Those are Microsoft Windows Dynamic RPC ports, a.k.a. Web RPC ports.

Normally, I just block the reserved port 1024 and the 3 ports used for Web 
RPC 1025-1027 for both TCP and UDP.

The probes have been going on for at least a year.

Merton Campbell Crockett


-- 
BEGIN:				vcard
VERSION:			3.0
FN:				Merton Campbell Crockett
ORG:				General Dynamics Advanced Information Systems;
				Intelligence and Exploitation Systems
N:				Crockett;Merton;Campbell
EMAIL;TYPE=internet:		mcc at CATO.GD-AIS.COM
TEL;TYPE=work,voice,msg,pref:	+1(805)497-5045
TEL;TYPE=work,fax:		+1(805)497-5050
TEL;TYPE=cell,voice,msg:	+1(805)377-6762
END:				vcard