[Dshield] Port 9571/tcp

Tomas L. Byrnes tomb at byrneit.net
Wed Jan 17 16:38:07 GMT 2007


Do you have a skype host on your network that is using 9571 as its port?
It could just be systems trying to connect to it and use it as a
supernode. 

Otherwise, 9571 is the Tivoli Netview web server port. Maybe there's a
vuln for Tivoli we don't know about?

 

-----Original Message-----
From: list-bounces at lists.dshield.org
[mailto:list-bounces at lists.dshield.org] On Behalf Of Jon R. Kibler
Sent: Wednesday, January 17, 2007 8:29 AM
To: list at lists.dshield.org
Subject: [Dshield] Port 9571/tcp

Hi,

Noticed 750+ scans targeting a single IP on 9571/tcp during the past
couple of days. Over 90% of the scans are originating from western
Europe (about half from FR), with about a half dozen originating from
Latin America and AOL, and 2 or 3 originating from eastern Asia. 

Anyone else seen similar scans? 

Any idea what may be using that port?

Only have firewall logs to go by, and they don't show a lot of detail
(i.e., TTL, etc.).

Jon
--
Jon R. Kibler
Chief Technical Officer
A.S.E.T., Inc.
Charleston, SC  USA
(843) 849-8214




==================================================
Filtered by: TRUSTEM.COM's Email Filtering Service
http://www.trustem.com/
No Spam. No Viruses. Just Good Clean Email.




More information about the list mailing list