[Dshield] Port 16387

Mike Yates myates at Washtechnical.com
Tue Mar 23 17:09:53 GMT 2004

Source ports are random.

----- Original Message ----- 
From: "Stephane Grobety" <security at admin.fulgan.com>
To: "General DShield Discussion List" <list at dshield.org>
Sent: Tuesday, March 23, 2004 4:44 AM
Subject: Re[2]: [Dshield] Port 16387

> BM> By any chance, do most of the incoming packets have source port
> BM> 4000? If so, you could be looking at Witty worm traffic.
> Witty uses a random destination port... I should know: it blew up my
> server...
> Good luck,
> Stephane
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see:

More information about the list mailing list