[Dshield] Many Hits on Port 26809
jgs316 at gmail.com
Wed Aug 31 13:58:34 GMT 2005
On 8/30/05, Rick Friedman wrote:
> In the last 18 minutes, I've received 60 hits on udp port 26809. They
> are coming from at least 20 different IPs. Many different domains
> involved from Japan, Australia, Taiwan, Bulgaria, US, etc.
> Has anyone else noticed anything like this??
do they all have the same source port? I had something similar to that a
while ago where I would get about 60 packets to these high udp ports, and
they would come from some ibm systems. I had done some research, and they
were all coming from the same source port, and that was a lower numberd port
that was used for some other application. What I believe was happening was
somebody spoofing their packets to my ip address trying to create a DoS
against the application on those ibm servers. I haven't seen that in quite a
few months though.
More information about the list