RE: Slow scan on high-ports?

["Wolf, Glenn" <glenn.wolf () we-inc com>]

Yum!

PCAnywhere        65301/tcp

Glenn


-----Original Message-----
From: Rolf Jürrens [mailto:security () rolf-juerrens de] 
Sent: Tuesday, October 29, 2002 12:39 AM
To: security-basics () securityfocus com
Subject: Slow scan on high-ports?


Hi everyone,

in our firewall-logs I see a slow scan  over our whole network  from one IP
address on tcp ports >65300. The scan lasts now about 24 hours with only 50
packets. What is the purpose of such a scan? Since all ports are normally
closed in these ranges, no one can expect to gather information about a
network - am I right? Or are there any interesting ports in this range? By
the way: the IP address appears in the dshield.org database as an attacker
address.

Greetings

Rolf