[Dshield] Many Hits on Port 26809

Justin S jgs316 at gmail.com
Wed Aug 31 13:58:34 GMT 2005


On 8/30/05, Rick Friedman wrote: 
> 
> In the last 18 minutes, I've received 60 hits on udp port 26809. They
> are coming from at least 20 different IPs. Many different domains
> involved from Japan, Australia, Taiwan, Bulgaria, US, etc.
> 
> Has anyone else noticed anything like this??

 do they all have the same source port? I had something similar to that a 
while ago where I would get about 60 packets to these high udp ports, and 
they would come from some ibm systems. I had done some research, and they 
were all coming from the same source port, and that was a lower numberd port 
that was used for some other application. What I believe was happening was 
somebody spoofing their packets to my ip address trying to create a DoS 
against the application on those ibm servers. I haven't seen that in quite a 
few months though.


More information about the list mailing list