[Dshield] port probe increase on 3531

Jeff Kell jeff-kell at utc.edu
Tue Dec 2 21:48:59 GMT 2003


Bruyere, Michel wrote:

> Hi, 
> 	I saw an increase of port probing on the 3531 port. Someone know
> what this can be? 
> There is 2 pattern that I noted, the firt is Source port is always 3531 as
> well as dest port and the other "kind" of probes are coming from source
> around 2300 and up.
> It kinda dropped since 30 nov 2003. This date was the highest peak.

3531 is used by Jolt, a download accelerator that comes with the new 
Kazaa desktop.  It, in turn, manages to randomize download ports.

Jeff




More information about the list mailing list