[Dshield] Scanning port 17-tcp, 23-tcp and 7-tcp

Oswaldo Espinosa hanumatt901 at yahoo.com
Tue Aug 23 22:10:29 GMT 2005


Hello,
 
I'm seeing some messages in our internal network indicating an event Echo_Reply_Without_Request
icmp Type:0 Code:0
id: 0x0200
data: 0xFFD8FFFE000857414E473202FFE000104A46494600010101006000600000FFDB004300100B0C0E0C0A100E0D0E1211101318281A18161618312325
 
>From one host which is on the net of other hosts which sent some days ago probes to the same server (domain controller) to the ports 17-tpc, 23-tcp and 7-tcp
 
I've checked the logs in those PCs but nothing appears to indicate those PCs were compromised, also googled those ports looking for some type or attack or tool which could have generated but nothing.
 
Anyone can help me to understand what is going on on that net or maybe help me to understand the data of the message?

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 


More information about the list mailing list