Re: patternmatch for scan

["Chuck Swiger" <chuck () codefab com>]

On Sat, 19 Feb 2000 08:56:21 -0500, Kenneth_W_Fox () sbphrd com wrote:
> Is anyone familiar with an attack or probe which begins or ends with
> scanning only ports 3128 & 8080 on a target box? I've been seeing alot of
> this lately in various places.

3128 is the default port used by the Squid web proxy; 8080 is another common  
port used either by a web server run by a normal user (as opposed to port  
80, which requires root) or as another common port for proxying.

-Chuck

       Chuck 'Sisyphus' Swiger | chuck () codefab com | Bad cop!  No Donut.
       ------------------------+-------------------+--------------------
       I know that you are an optimist if you think I am a pessimist....