[Dshield] Interesting changes in scans yesterday...

Jon R. Kibler Jon.Kibler at aset.com
Thu Feb 12 15:56:32 GMT 2004


Greetings...

Just looked at our router log reports from yesterday. Most days, scan rates on the top 20 ports do not vary much from day to day (up or down by maybe 50% to 75%), but yesterday had some real strange numbers:

TCP	Delta
-----	-------
  135	 +4443%
  445	 +1862%
   23	 +1000%
 6129	  +205%
 3127	  +123%
   80	  -118%
   25	  -130%
 1080	  -170%
 3128	  -181%
  139	 -4640%

UDP	Delta
-----	-------
  137	  -198%
  135	  -200%
 1443	  -230%
   53    -2500%

Not sure what to attribute this to... Big changes on a couple of ports are not unusual when some new worm comes out, but such big changes on so many ports... can't remember ever seeing so many and so big of changes from day to day -- especially when the previous day was about the same as every other day recently.

Also, I might add that today appears to be "back to normal" thus far.

Jon
-- 
Jon R. Kibler
Chief Technical Officer
A.S.E.T., Inc.
Charleston, SC  USA
(843) 849-8214




==================================================
Filtered by: TRUSTEM.COM's Email Filtering Service
http://www.trustem.com/
No Spam. No Viruses. Just Good Clean Email.



More information about the list mailing list