[unisog] large netflow values and skype?

Reg Quinton reggers at ist.uwaterloo.ca
Thu Jun 22 17:02:08 GMT 2006


From: "Peter Van Epp" <vanepp at sfu.ca>
>        Yep, although without a firewall it isn't usually 80 or 53 :-). 
> Check
> for flows with a dest port of 33033 which is the Skype directory service.

Peter, thanks for the extra information. Skype has been a problem here by 
times, not as much lately. People who keep their XP/SP2 firewall up don't 
become super nodes ....

In your note about directory services is that 33033 TCP or UDP?

Snort has some good signatures on skype, but none on that twig on that port 
number.



More information about the unisog mailing list