[Dshield] High counts on RPC probes from my own servers
Thompson, John J
ThompsonJJ at mail.medicine.uiowa.edu
Tue Aug 27 15:50:56 GMT 2002
To simplify the model, lets say I have win2k server a and b both with black
ice server installed.
Im getting RPC get port probes on port 111, prog = 100005 & reason =
ICMPsent with counts above 400.
Im also getting RPC TCP port probes on port 111 with counts above 6000.
This traffic is coming from one server to the other with server A creating
the first error listed on B and vice versa for the next error.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the list