[Dshield] TCP Port 17300 scans increased

Blake McNeill mcneillb at LinkLogger.com
Thu Jul 25 20:27:13 GMT 2002


The graphs shown are just my home system.  Others have noticed this as well:

http://www.dslreports.com/forum/remark,3927097~root=security,1~mode=flat

I was asking if anyone has seen these as I'm trying to figure out how wide
spread this is.  A lot of IDS systems tend not to watch this port so
firewall logging is typically what is showing the increases in this port
scan.  I have not seen any of these scans since early this morning so it
appears to have spiked and stopped here.  I saw 31 scans from 16 sources
from midnight to 2am (MST) and then nothing since which is very unusual.  I
saw these scans starting at yesterday at about 10:30am.

Blake

----- Original Message -----
From: "John Hardin" <johnh at aproposretail.com>
To: "DShield mailing list" <list at dshield.org>
Sent: Thursday, July 25, 2002 1:36 PM
Subject: Re: [Dshield] TCP Port 17300 scans increased


> On Thu, 2002-07-25 at 10:56, Blake McNeill wrote:
> > Anyone else seeing an increase in TCP port 17300 scans starting
yesterday?
> >
> > http://www.members.shaw.ca/mcneillb/images/July24k.gif
> >
> > http://www.members.shaw.ca/mcneillb/images/July24l.gif
>
>    http://www.dshield.org/port_report.php?port=17300
>
> Maybe we need to refine the port activity report to reduce these kinds
> of questions on the list - perhaps it would be useful to add the number
> of reporting sites to the report.
>
> --
> John Hardin                                   <johnh at aproposretail.com>
> Internal Systems Administrator                    voice: (425) 672-1304
> Apropos Retail Management Systems, Inc.             fax: (425) 672-0192
> -----------------------------------------------------------------------
>  "To disable the Internet to save EMI and Disney is the moral
>   equivalent of burning down the library of Alexandria to ensure the
>   livelihood of monastic scribes."
>                                     -- John Ippolito of the Guggenheim
> -----------------------------------------------------------------------
>  302 days until The Matrix Reloaded
>
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list