[unisog] Anyone notice an increase in window probes/pokes/whatever

Ken Connelly Ken.Connelly at uni.edu
Wed Feb 18 12:02:09 GMT 2004


Pete Hickey wrote:

>At around Tue Feb 17 5:10 AM EST we saw a sudden 10 fold
>increase in scans/probes/pokes coming in on ports 445 and 135.
>It continued throughout the day, and is now only about 4 times
>over normal.
>
>Anyone else seeing this?
>
We're still blocking 135 outside the IDS, and I've given serious 
consideration to adding 445 to that, but haven't done so quite yet.  At 
any rate, my huge jump in 445 scans was on the 12th-14th.  the 12th was 
more than 50 times the day before and the 14th was nearly 40 times the 
day after.

-- 
- Ken
===========================================================================
Ken Connelly (KC152) Systems and Operations Manager, ITS - Network Services
University of Northern Iowa                     Cedar Falls, IA  50614-0121
email: Ken.Connelly at uni.edu    phone: (319) 273-5850    fax: (319) 273-7373

It's much more important to know what you don't know than what you do know!






More information about the unisog mailing list