[Dshield] Port 16387

Mike Yates myates at Washtechnical.com
Tue Mar 23 17:18:08 GMT 2004


No such luck.

Last nights average was over 300 per minute , all to the same port.  I can't
find a specific purpose for the port nor anything known to use it.

Oh yeah, source ports are all over the map.

Mike
----- Original Message ----- 
From: "Bill McCarty" <bmccarty at pt-net.net>
To: "General DShield Discussion List" <list at dshield.org>
Sent: Monday, March 22, 2004 10:05 PM
Subject: Re: [Dshield] Port 16387


> Hi Mike,
>
> --On Monday, March 22, 2004 4:38 PM -0800 Mike Yates
> <myates at Washtechnical.com> wrote:
>
> > We are receiving an unusually high number of port scans to 16387 (248
per
> > minute) from over 3 dozen IPs.  Anyone else seeing this or know of a new
> > worm wandering the world that's using this port?
>
> By any chance, do most of the incoming packets have source port 4000? If
> so, you could be looking at Witty worm traffic.
>
> Cheers,
>
> ---------------------------------------------------
> Bill McCarty
>
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list




More information about the list mailing list