[unisog] What would cause an alert like this?

Dave Monnier, IT Security Office, Indiana University dmonnier at iu.edu
Wed Feb 16 19:20:53 GMT 2005


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Clyde Hoadley wrote:
> What would cause this?  The "nnn.nnn.xxx.153" is a Windows XP
> computer.  The desktop support technician reported that he didn't
> find anything wrong with the workstation.  He did say it had a
> game called "America's Army" installed.  Would that have caused
> this?  I've only seen this alert once.
> 
>>02/14/2005 09:20:04.128 -     Probable Port Scan -
>>Source:nnn.nnn.xxx.153, 1480, WAN -     Destination:255.255.255.255,
>>7787, LAN -     UDP scanned port list, 8777, 7778, 7779, 7780, 7781,
>>7782, 7783, 7784, 7785, 7786 -    
> 

That is normal behavior for the game engine.  It's looking for LAN based
games.

Cheers,
- -Dave

- --
| Dave Monnier - dmonnier at iu.edu - http://php.indiana.edu/~dmonnier/ |
|  Lead Security Engineer, Information Technology Security Office    |
|  Office of the VP for Information Technology, Indiana University   |

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCE50VBIf6jlONJjIRAlRLAKDCkPWbF20i5yoHuMNvniL+J+PlGwCePe65
3VoJCR5b3ixlpvhpSmGuR2E=
=FzI9
-----END PGP SIGNATURE-----



More information about the unisog mailing list