[Dshield] Different probe port each day

Meidinger Chris chris.meidinger at badenit.de
Fri Apr 30 10:33:38 GMT 2004


Maybe a distributed scan hoping to slip under the radar - minimizing packets
trying not to trip IDS scan threshholds?

Just an idea, 

Chris  

> -----Original Message-----
> From: list-bounces at lists.dshield.org 
> [mailto:list-bounces at lists.dshield.org] On Behalf Of Kenneth Porter
> Sent: Friday, April 30, 2004 12:23 AM
> To: DShield List
> Subject: [Dshield] Different probe port each day
> 
> The last few days I've been getting probed from a couple 
> dozen systems on a different port each day. One day it was 
> 32768, yesterday it was TCP 559, today it's 65506 with a few 
> 901's. Any idea what this is? Could it be some anti-spam 
> thing that mail servers are doing now? (This is on a mail
> gateway.)
> 
> _______________________________________________
> list mailing list
> list at lists.dshield.org
> To change your subscription options (or unsubscribe), see: 
> http://www.dshield.org/mailman/listinfo/list
> 



More information about the list mailing list