[Dshield] port 445

Jeff Kell jeff-kell at utc.edu
Wed Mar 16 14:52:17 GMT 2005


Aaron Lewis wrote:
> I have started seeing this also. Port 445 and 139 scans are very heavy. All
> from the same class C for me

> From: Lauro, John

> I am seeing a massive amount of traffic to port 445 that started a
> little over 3 hours ago.  (about 1300 packets a second to our class
> B).  

My summary from last night shows
> Port	Packets	Sources	Targets	Service	Name
> 445	53614	2230	626	microsoft-ds  	Win2k+ Server Message Block  
> 139	50790	413	705	netbios-ssn  	NETBIOS Session Service  

This is from two /22 tarpits.

Jeff



More information about the list mailing list