[unisog] As the worm turns, Slapper variants begin using UDP ports 4156 and 1978 (instead of 2002)

Andreas Östling andreaso at it.su.se
Sun Sep 22 22:22:07 GMT 2002


On Sun, 22 Sep 2002, Rich Graves wrote:

> 129.64.154.73    12.240.146.45    17    27015    4156     333         2
> 129.64.154.73    61.35.130.76     17    27015    4156     330         2
> 129.64.154.73    24.95.183.243    17    27015    4156     330         2

Hmm, 27015/UDP... are you sure that's not just a game server?
(used in education, of course)

We recently had a couple of infected machines, flooding 4156/udp <->
4156/UDP. Nothing on 1978/UDP so far.

Regards,
Andreas Östling



More information about the unisog mailing list