[Dshield] TCP Port 17300 scans increased

Mrcorp mrcorp at yahoo.com
Thu Jul 25 21:07:33 GMT 2002


IDS's watch ports? Hmm.. maybe a nnids does.  I thought nids watched the traffic, and hids watched
file integrity.

mrcorp

--- Blake McNeill <mcneillb at linklogger.com> wrote:
> The graphs shown are just my home system.  Others have noticed this as well:
> 
> http://www.dslreports.com/forum/remark,3927097~root=security,1~mode=flat
> 
> I was asking if anyone has seen these as I'm trying to figure out how wide
> spread this is.  A lot of IDS systems tend not to watch this port so
> firewall logging is typically what is showing the increases in this port
> scan.  I have not seen any of these scans since early this morning so it
> appears to have spiked and stopped here.  I saw 31 scans from 16 sources
> from midnight to 2am (MST) and then nothing since which is very unusual.  I
> saw these scans starting at yesterday at about 10:30am.
> 
> Blake
> 
> ----- Original Message -----
> From: "John Hardin" <johnh at aproposretail.com>
> To: "DShield mailing list" <list at dshield.org>
> Sent: Thursday, July 25, 2002 1:36 PM
> Subject: Re: [Dshield] TCP Port 17300 scans increased
> 
> 
> > On Thu, 2002-07-25 at 10:56, Blake McNeill wrote:
> > > Anyone else seeing an increase in TCP port 17300 scans starting
> yesterday?
> > >
> > > http://www.members.shaw.ca/mcneillb/images/July24k.gif
> > >
> > > http://www.members.shaw.ca/mcneillb/images/July24l.gif
> >
> >    http://www.dshield.org/port_report.php?port=17300
> >
> > Maybe we need to refine the port activity report to reduce these kinds
> > of questions on the list - perhaps it would be useful to add the number
> > of reporting sites to the report.
> >
> > --
> > John Hardin                                   <johnh at aproposretail.com>
> > Internal Systems Administrator                    voice: (425) 672-1304
> > Apropos Retail Management Systems, Inc.             fax: (425) 672-0192
> > -----------------------------------------------------------------------
> >  "To disable the Internet to save EMI and Disney is the moral
> >   equivalent of burning down the library of Alexandria to ensure the
> >   livelihood of monastic scribes."
> >                                     -- John Ippolito of the Guggenheim
> > -----------------------------------------------------------------------
> >  302 days until The Matrix Reloaded
> >
> > _______________________________________________
> > Dshield mailing list
> > Dshield at dshield.org
> > To change your subscription options (or unsubscribe), see:
> http://www.dshield.org/mailman/listinfo/list
> 
> _______________________________________________
> Dshield mailing list
> Dshield at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list


__________________________________________________
Do You Yahoo!?
Yahoo! Health - Feel better, live better
http://health.yahoo.com




More information about the list mailing list