[DShield] 3127/tcp by Doomjuice (Kaspersky) - MyDoom takeover?

Bill McCarty bmccarty at pt-net.net
Mon Feb 9 21:57:26 GMT 2004


Hi all,

--On Monday, February 09, 2004 2:49 PM -0600 Micheal Patterson 
<micheal at tsgincorporated.com> wrote:

> Since 00:01 this morning, I've had 11219 attempts on port 3127 from random
> IP's. Where I've also had 522 for port 3128 and 1080 each in matched sets
> of IP's.

I've seen similar traffic ratios in which ports 1080 and 3128 are probed by 
a single source:

Port      Packets Sources Targets
tcp  1080     114       3      39
tcp  3127    1347      21      69
tcp  3128     114       3      39

But, inspection of the traffic on ports 1080 and 3128 shows that it results 
from an automatic scanner that probes the following ports, some of them 
repetitively:

21
22
23
25
80
110
1080
3128
8080

This data doesn't seem consistent with the obvious prevalent hypothesis 
that the port 3127 traffic has the same origin as the port 1080 and port 
3128 traffic.

Here's related Argus Netflow data showing such a series of probes. Times 
are UTC-8:00:

09 Feb 04 11:28:48    man version=2.0     probeid=3848370891 STA
09 Feb 04 10:36:18    tcp    193.252.51.3.1422   ->     XXX.XXX.XXX.28.21 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1424   ->     XXX.XXX.XXX.36.21 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1426   ->     XXX.XXX.XXX.81.21 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1428   ->    XXX.XXX.XXX.130.21 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1439   ->     XXX.XXX.XXX.28.23 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1441   ->     XXX.XXX.XXX.36.23 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1443   ->     XXX.XXX.XXX.81.23 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1445   ->    XXX.XXX.XXX.130.23 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1447   ->     XXX.XXX.XXX.28.25 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1448   ->     XXX.XXX.XXX.30.25 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1450   ->     XXX.XXX.XXX.71.25 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1451   ->     XXX.XXX.XXX.81.25 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1453   ->    XXX.XXX.XXX.130.25 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1455   ->     XXX.XXX.XXX.28.80 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1459   ->     XXX.XXX.XXX.71.80 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1460   ->     XXX.XXX.XXX.81.80 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1461   ->    XXX.XXX.XXX.128.80 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1462   ->    XXX.XXX.XXX.130.80 1 
1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1463   ->     XXX.XXX.XXX.12.110 
1       1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1464   ->     XXX.XXX.XXX.28.110 
1       1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1465   ->     XXX.XXX.XXX.30.110 
1       1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1467   ->     XXX.XXX.XXX.71.110 
1       1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1468   ->     XXX.XXX.XXX.81.110 
1       1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1469   ->    XXX.XXX.XXX.128.110 
1       1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1471   ->     XXX.XXX.XXX.12.1080 
1      1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1470   ->    XXX.XXX.XXX.130.110 
1       1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1472   ->     XXX.XXX.XXX.28.1080 
1      1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1473   ->     XXX.XXX.XXX.30.1080 
1      1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1474   ->     XXX.XXX.XXX.36.1080 
1      1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1476   ->     XXX.XXX.XXX.81.1080 
1      1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1475   ->     XXX.XXX.XXX.71.1080 
1      1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1477   ->    XXX.XXX.XXX.128.1080 
1      1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1478   ->    XXX.XXX.XXX.130.1080 
1      1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1479   ->     XXX.XXX.XXX.12.3128 
1      1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1480   ->     XXX.XXX.XXX.28.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1481   ->     XXX.XXX.XXX.30.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1482   ->     XXX.XXX.XXX.36.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1483   ->     XXX.XXX.XXX.71.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1484   ->     XXX.XXX.XXX.81.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1485   ->    XXX.XXX.XXX.128.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1486   ->    XXX.XXX.XXX.130.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1487   ->     XXX.XXX.XXX.12.8080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1488   ->     XXX.XXX.XXX.28.8080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp   XXX.XXX.XXX.12.2725  ->      193.252.51.3.113 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1489   ->     XXX.XXX.XXX.30.8080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1428   ->    XXX.XXX.XXX.130.21 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1426   ->     XXX.XXX.XXX.81.21 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1422   ->     XXX.XXX.XXX.28.21 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1424   ->     XXX.XXX.XXX.36.21 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1490   ->     XXX.XXX.XXX.36.8080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1450   ->     XXX.XXX.XXX.71.25 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1451   ->     XXX.XXX.XXX.81.25 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1441   ->     XXX.XXX.XXX.36.23 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1447   ->     XXX.XXX.XXX.28.25 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1448   ->     XXX.XXX.XXX.30.25 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1445   ->    XXX.XXX.XXX.130.23 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1443   ->     XXX.XXX.XXX.81.23 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1439   ->     XXX.XXX.XXX.28.23 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1453   ->    XXX.XXX.XXX.130.25 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1491   ->     XXX.XXX.XXX.71.8080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1465   ->     XXX.XXX.XXX.30.110 
1       1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1471   ->     XXX.XXX.XXX.12.1080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1455   ->     XXX.XXX.XXX.28.80 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1460   ->     XXX.XXX.XXX.81.80 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1459   ->     XXX.XXX.XXX.71.80 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1469   ->    XXX.XXX.XXX.128.110 
1       1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1470   ->    XXX.XXX.XXX.130.110 
1       1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1462   ->    XXX.XXX.XXX.130.80 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1468   ->     XXX.XXX.XXX.81.110 
1       1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1463   ->     XXX.XXX.XXX.12.110 
1       1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1467   ->     XXX.XXX.XXX.71.110 
1       1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1461   ->    XXX.XXX.XXX.128.80 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1464   ->     XXX.XXX.XXX.28.110 
1       1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1492   ->     XXX.XXX.XXX.81.8080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1493   ->    XXX.XXX.XXX.128.8080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1475   ->     XXX.XXX.XXX.71.1080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1472   ->     XXX.XXX.XXX.28.1080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1481   ->     XXX.XXX.XXX.30.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1474   ->     XXX.XXX.XXX.36.1080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1479   ->     XXX.XXX.XXX.12.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1477   ->    XXX.XXX.XXX.128.1080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1476   ->     XXX.XXX.XXX.81.1080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1480   ->     XXX.XXX.XXX.28.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1473   ->     XXX.XXX.XXX.30.1080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1478   ->    XXX.XXX.XXX.130.1080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1483   ->     XXX.XXX.XXX.71.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1484   ->     XXX.XXX.XXX.81.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1482   ->     XXX.XXX.XXX.36.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1486   ->    XXX.XXX.XXX.130.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1485   ->    XXX.XXX.XXX.128.3128 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1494   ->    XXX.XXX.XXX.130.8080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1487   ->     XXX.XXX.XXX.12.8080 
1      1         0            0           RST
09 Feb 04 10:36:19    tcp    193.252.51.3.1488   ->     XXX.XXX.XXX.28.8080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1489   ->     XXX.XXX.XXX.30.8080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1426   ->     XXX.XXX.XXX.81.21 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1428   ->    XXX.XXX.XXX.130.21 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1422   ->     XXX.XXX.XXX.28.21 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1490   ->     XXX.XXX.XXX.36.8080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1424   ->     XXX.XXX.XXX.36.21 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1450   ->     XXX.XXX.XXX.71.25 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1451   ->     XXX.XXX.XXX.81.25 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1441   ->     XXX.XXX.XXX.36.23 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1447   ->     XXX.XXX.XXX.28.25 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1448   ->     XXX.XXX.XXX.30.25 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1445   ->    XXX.XXX.XXX.130.23 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1443   ->     XXX.XXX.XXX.81.23 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1453   ->    XXX.XXX.XXX.130.25 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1439   ->     XXX.XXX.XXX.28.23 1 
1         0            0           RST
09 Feb 04 10:36:19    tcp   XXX.XXX.XXX.12.2726  ->      193.252.51.3.113 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1471   ->     XXX.XXX.XXX.12.1080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1460   ->     XXX.XXX.XXX.81.80 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1469   ->    XXX.XXX.XXX.128.110 
1       1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1462   ->    XXX.XXX.XXX.130.80 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1468   ->     XXX.XXX.XXX.81.110 
1       1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1465   ->     XXX.XXX.XXX.30.110 
1       1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1455   ->     XXX.XXX.XXX.28.80 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1459   ->     XXX.XXX.XXX.71.80 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1491   ->     XXX.XXX.XXX.71.8080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1470   ->    XXX.XXX.XXX.130.110 
1       1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1467   ->     XXX.XXX.XXX.71.110 
1       1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1463   ->     XXX.XXX.XXX.12.110 
1       1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1461   ->    XXX.XXX.XXX.128.80 1 
1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1475   ->     XXX.XXX.XXX.71.1080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1479   ->     XXX.XXX.XXX.12.3128 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1472   ->     XXX.XXX.XXX.28.1080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1476   ->     XXX.XXX.XXX.81.1080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1492   ->     XXX.XXX.XXX.81.8080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1480   ->     XXX.XXX.XXX.28.3128 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1481   ->     XXX.XXX.XXX.30.3128 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1473   ->     XXX.XXX.XXX.30.1080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1474   ->     XXX.XXX.XXX.36.1080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1477   ->    XXX.XXX.XXX.128.1080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1493   ->    XXX.XXX.XXX.128.8080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1464   ->     XXX.XXX.XXX.28.110 
1       1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1478   ->    XXX.XXX.XXX.130.1080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1484   ->     XXX.XXX.XXX.81.3128 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1486   ->    XXX.XXX.XXX.130.3128 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1483   ->     XXX.XXX.XXX.71.3128 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1482   ->     XXX.XXX.XXX.36.3128 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1485   ->    XXX.XXX.XXX.128.3128 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1494   ->    XXX.XXX.XXX.130.8080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1487   ->     XXX.XXX.XXX.12.8080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1488   ->     XXX.XXX.XXX.28.8080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1489   ->     XXX.XXX.XXX.30.8080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1490   ->     XXX.XXX.XXX.36.8080 
1      1         0            0           RST
09 Feb 04 10:36:20    tcp    193.252.51.3.1491   ->     XXX.XXX.XXX.71.8080 
1      1         0            0           RST
09 Feb 04 10:36:21    tcp    193.252.51.3.1492   ->     XXX.XXX.XXX.81.8080 
1      1         0            0           RST
09 Feb 04 10:36:21    tcp    193.252.51.3.1493   ->    XXX.XXX.XXX.128.8080 
1      1         0            0           RST
09 Feb 04 10:36:21    tcp    193.252.51.3.1494   ->    XXX.XXX.XXX.130.8080 
1      1         0            0           RST
09 Feb 04 10:36:10   icmp    193.252.51.3        ->      XXX.XXX.XXX.8 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3        ->     XXX.XXX.XXX.10 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3        ->     XXX.XXX.XXX.16 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3        ->     XXX.XXX.XXX.19 1 
0         66           0           ECO
09 Feb 04 10:36:12   icmp    193.252.51.3        ->    XXX.XXX.XXX.132 1 
0         66           0           ECO
09 Feb 04 10:36:12   icmp    193.252.51.3        ->     XXX.XXX.XXX.72 1 
0         66           0           ECO
09 Feb 04 10:36:12   icmp    193.252.51.3        ->     XXX.XXX.XXX.76 1 
0         66           0           ECO
09 Feb 04 10:36:12   icmp    193.252.51.3        ->     XXX.XXX.XXX.78 1 
0         66           0           ECO
09 Feb 04 10:36:12   icmp    193.252.51.3        ->     XXX.XXX.XXX.79 1 
0         66           0           ECO
09 Feb 04 10:36:12   icmp    193.252.51.3        ->     XXX.XXX.XXX.80 1 
0         66           0           ECO
09 Feb 04 10:36:12   icmp    193.252.51.3        ->     XXX.XXX.XXX.82 1 
0         66           0           ECO
09 Feb 04 10:36:12   icmp    193.252.51.3        ->     XXX.XXX.XXX.83 1 
0         66           0           ECO
09 Feb 04 10:36:12   icmp    193.252.51.3        ->     XXX.XXX.XXX.86 1 
0         66           0           ECO
09 Feb 04 10:36:18    tcp    193.252.51.3.1429  <->     XXX.XXX.XXX.12.22 1 
1         0            0           TIM
09 Feb 04 10:36:18    tcp    193.252.51.3.1430  <->     XXX.XXX.XXX.28.22 1 
1         0            0           TIM
09 Feb 04 10:36:18    tcp    193.252.51.3.1431   ->     XXX.XXX.XXX.30.22 3 
0         0            0           REQ
09 Feb 04 10:36:18    tcp    193.252.51.3.1432  <-      XXX.XXX.XXX.36.22 1 
1         0            0           ACC
09 Feb 04 10:36:18    tcp    193.252.51.3.1434  <-      XXX.XXX.XXX.71.22 1 
1         0            0           ACC
09 Feb 04 10:36:18    tcp    193.252.51.3.1435  <-      XXX.XXX.XXX.81.22 1 
1         0            0           ACC
09 Feb 04 10:36:18    tcp    193.252.51.3.1436  <-     XXX.XXX.XXX.128.22 1 
1         0            0           ACC
09 Feb 04 10:36:18    tcp    193.252.51.3.1437  <-     XXX.XXX.XXX.130.22 1 
1         0            0           ACC
09 Feb 04 10:36:18    tcp    193.252.51.3.1438   ->     XXX.XXX.XXX.12.23 
10       9         35           134         RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1440   ->     XXX.XXX.XXX.30.23 9 
8         26           59          FIN
09 Feb 04 10:36:18    tcp    193.252.51.3.1442   ->     XXX.XXX.XXX.71.23 5 
5         2            12          FIN
09 Feb 04 10:36:18    tcp    193.252.51.3.1444   ->    XXX.XXX.XXX.128.23 4 
3         2            0           FIN
09 Feb 04 10:36:18    tcp    193.252.51.3.1446   ->     XXX.XXX.XXX.12.25 6 
5         2            156         RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1425   ->     XXX.XXX.XXX.71.21 4 
3         2            0           FIN
09 Feb 04 10:36:18    tcp    193.252.51.3.1449   ->     XXX.XXX.XXX.36.25 6 
5         2            159         RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1452   ->    XXX.XXX.XXX.128.25 4 
3         2            0           FIN
09 Feb 04 10:36:18    tcp    193.252.51.3.1454   ->     XXX.XXX.XXX.12.80 7 
5         18           3221        RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1456   ->     XXX.XXX.XXX.30.80 4 
6         18           307         FIN
09 Feb 04 10:36:18    tcp    193.252.51.3.1458   ->     XXX.XXX.XXX.36.80 5 
5         18           671         FIN
09 Feb 04 10:36:10   icmp    193.252.51.3        ->     XXX.XXX.XXX.21 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3        ->      XXX.XXX.XXX.2 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3        ->      XXX.XXX.XXX.3 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3        ->      XXX.XXX.XXX.4 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3        ->      XXX.XXX.XXX.6 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3        ->     XXX.XXX.XXX.23 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3        ->     XXX.XXX.XXX.24 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3       <->     XXX.XXX.XXX.28 1 
1         66           66          ECO
09 Feb 04 10:36:12   icmp    193.252.51.3        ->     XXX.XXX.XXX.87 1 
0         66           0           ECO
09 Feb 04 10:36:12   icmp    193.252.51.3        ->     XXX.XXX.XXX.88 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3       <->     XXX.XXX.XXX.30 1 
1         66           66          ECO
09 Feb 04 10:36:10   icmp    193.252.51.3       <->     XXX.XXX.XXX.36 1 
1         66           66          ECO
09 Feb 04 10:36:10   icmp    193.252.51.3        ->      XXX.XXX.XXX.7 1 
0         66           0           ECO
09 Feb 04 10:36:10   icmp    193.252.51.3       <->     XXX.XXX.XXX.12 1 
1         66           66          ECO
09 Feb 04 10:36:18    tcp    193.252.51.3.1466   ->     XXX.XXX.XXX.36.110 
6       5         2            93          RST
09 Feb 04 10:36:12   icmp    193.252.51.3       <->     XXX.XXX.XXX.71 1 
1         66           66          ECO
09 Feb 04 10:36:12   icmp    193.252.51.3       <->    XXX.XXX.XXX.128 1 
1         66           66          ECO
09 Feb 04 10:36:12   icmp    193.252.51.3       <->    XXX.XXX.XXX.130 1 
1         66           66          ECO
09 Feb 04 10:36:12   icmp    193.252.51.3       <->     XXX.XXX.XXX.81 1 
1         66           66          ECO
09 Feb 04 10:36:18    tcp    193.252.51.3.1421   ->     XXX.XXX.XXX.12.21 6 
5         2            176         RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1423   ->     XXX.XXX.XXX.30.21 7 
5         2            67          RST
09 Feb 04 10:38:49    tcp  XXX.XXX.XXX.128.1069   ->      193.252.51.3.113 
1       1         0            0           RST
09 Feb 04 10:36:18    tcp    193.252.51.3.1427   ->    XXX.XXX.XXX.128.21 4 
3         2            0           FIN
09 Feb 04 10:38:00    tcp    193.252.51.3.1425   ->     XXX.XXX.XXX.71.21 1 
2         0            166         RST
09 Feb 04 10:41:23    tcp    193.252.51.3.1427   ->    XXX.XXX.XXX.128.21 1 
2         0            193         RST
09 Feb 04 10:38:49    tcp    193.252.51.3.1444   ->    XXX.XXX.XXX.128.23 1 
2         0            12          RST
09 Feb 04 10:38:49    tcp    193.252.51.3.1452   ->    XXX.XXX.XXX.128.25 1 
2         0            130         RST

---------------------------------------------------
Bill McCarty




More information about the list mailing list