[Dshield] High counts on RPC probes from my own servers

Thompson, John J ThompsonJJ at mail.medicine.uiowa.edu
Tue Aug 27 15:50:56 GMT 2002


To simplify the model, lets say I have win2k server a and b both with black
ice server installed. 
 
Im getting RPC get port probes on port 111, prog = 100005 & reason =
ICMPsent with counts above 400. 
 
Im also getting RPC TCP port probes on port 111 with counts above 6000.  
 
This traffic is coming from one server to the other with server A creating
the first error listed on B and vice versa for the next error. 
 
Any thoughts?
 
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.dshield.org/pipermail/list/attachments/20020827/73355bcd/attachment.htm


More information about the list mailing list