[Dshield] Snort's been pickin up lots of WAP port scans lately

David McCall david at atgi.net
Fri Oct 8 14:01:34 GMT 2004


What's up with these?

New kind of attack or profiling from the air waves?

example log:

2004-10-07 04:17:32 -07:00	16908764	1	211.219.244.206	1867	66.224.24.111
9200	TCP	S
2004-10-07 04:17:32 -07:00	16908764	1	211.219.244.206	1868	66.224.24.112
9200	TCP	S
2004-10-07 04:17:34 -07:00	16908764	1	211.219.244.206	1877	66.224.24.116
9200	TCP	S
2004-10-07 04:17:33 -07:00	16908764	1	211.219.244.206	1878	66.224.24.117
9200	TCP	S
2004-10-07 04:17:32 -07:00	16908764	1	211.219.244.206	1881	66.224.24.119
9200	TCP	S
2004-10-07 04:17:33 -07:00	16908764	1	211.219.244.206	1882	66.224.24.120
9200	TCP	S
2004-10-07 04:17:40 -07:00	16908764	1	211.219.244.206	1877	66.224.24.116
9200	TCP	S

Advanced Telcom Inc.
UNIX Administration
====================
  admin at atgi.net
  david.mccall at ge.com




More information about the list mailing list