[Dshield] Port 16387

Mike Yates myates at Washtechnical.com
Tue Mar 23 17:09:53 GMT 2004


Source ports are random.


----- Original Message ----- 
From: "Stephane Grobety" <security at admin.fulgan.com>
To: "General DShield Discussion List" <list at dshield.org>
Sent: Tuesday, March 23, 2004 4:44 AM
Subject: Re[2]: [Dshield] Port 16387


> BM> By any chance, do most of the incoming packets have source port
> BM> 4000? If so, you could be looking at Witty worm traffic.
>
> Witty uses a random destination port... I should know: it blew up my
> server...
>
> Good luck,
> Stephane
>
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list