[unisog] Tcp/6101 spike

Kees Leune C.J.Leune at uvt.nl
Tue Jan 11 10:07:50 GMT 2005


On Sat, Jan 08, 2005 at 12:32:39PM +0100, Kees Leune wrote:
> Hi,
> I've been seeing spikes on tcp/6101 probes since yesterday or so. Haven't been
> able to capture packets yet. Any ideas what is causing this? The sans port
> graph at http://isc.sans.org/port_details.php?port=6101 seems to confirm my
> observation.

The internet storm center also reports something about this port on today's

"The 6101/TCP is theorized to be scanning for the Veritas BackupExec Agent
vulnerability discussed earlier
(http://isc.sans.org/diary.php?date=2004-12-16) in December."

More info at http://isc.sans.org/diary.php?date=2005-01-10


Drs. Kees Leune                                 Tilburg University
Researcher                                     Infolab, Room B 738
+31 13 466 2688                                    The Netherlands

More information about the unisog mailing list