[Dshield] Bizarre Activity Spurt...

Bo Nordgren bo at nordgren.net
Fri Oct 14 09:53:23 GMT 2005


> > I just had 232 hits on ports 1025 and 1026, all udp, in 42 seconds. All had
> <snip>
> > Anybody ever seen anything quite like this?
> 
> http://www.google.com/search?hl=en&q=udp+1025+1026+site%3Adshield.org&btnG=Google+Search

Boy is my face red :)

Is it a knock-knock access then? Snort should have said something if there was a payload
or a recognizable bad pattern.

--



More information about the list mailing list