[Dshield] Port 16387

Bill McCarty bmccarty at pt-net.net
Tue Mar 23 06:05:23 GMT 2004

Hi Mike,

--On Monday, March 22, 2004 4:38 PM -0800 Mike Yates 
<myates at Washtechnical.com> wrote:

> We are receiving an unusually high number of port scans to 16387 (248 per
> minute) from over 3 dozen IPs.  Anyone else seeing this or know of a new
> worm wandering the world that's using this port?

By any chance, do most of the incoming packets have source port 4000? If 
so, you could be looking at Witty worm traffic.


Bill McCarty

More information about the list mailing list