[Dshield] Increase in scanning activity coincident with release of Novarg?

John Hardin johnh at aproposretail.com
Tue Jan 27 16:34:39 GMT 2004


All:

I just checked my email quarantine and tarpit graphs this morning and
there's an interesting correlation: tarpitted traffic here increased
quite a bit almost exactly one hour after the first instances of Novarg
attacks started coming through, and has been steadily high since.

It appears to be primarily 1433/tcp traffic.

Can anyone else confirm this? Anybody think it means anything?

     http://boundary.aproposretail.com/~johnh/quarantine.html
     http://boundary.aproposretail.com/~johnh/tarpit.html


--
John Hardin  KA7OHZ                           
Internal Systems Administrator/Guru               voice: (425) 672-1304
Apropos Retail Management Systems, Inc.             fax: (425) 672-0192
-----------------------------------------------------------------------
  Failure to plan ahead on someone else's part does not constitute an
  emergency on my part.
                                  - David W. Barts in a.s.r
-----------------------------------------------------------------------
 34 days until ICQ Corp goes away - have you installed Jabber yet?




More information about the list mailing list