[Dshield] port 554 activity

Johannes Ullrich jullrich at euclidian.com
Tue Oct 28 17:43:04 GMT 2003

On Tue, 2003-10-28 at 11:52, Bjorn Stromberg wrote:
> Some time last night we started getting hit with scans from all over the
> world for port 554.

You are the second person to point this out. Indeed, it
looks like we have an increase in this traffic:

(looks at the red line, number of sources)

This port is used by the Real Time Stream Control Protocol, which I
think is used by Realserver (Real Audio). There was a vulnerability in
this application a few months back and exploits for it have been widely

Johannes Ullrich                     jullrich at euclidian.com
pgp key: http://johannes.homepc.org/PGPKEYS
   "We regret to inform you that we do not enable any of the 
    security functions within the routers that we install."
         support at covad.net

More information about the list mailing list