Re: Anyone else exoeriencing blasts o' port 6129 TCP?

[Jim Race <caferace () well com>]

Rob Schrack wrote:

> Oh yeah... just after Christmas, 6129 accounted for maybe 25% of the packets
> we submitted to dshield.  In the past 5 days, they've accounted for nearly
> 1/2 of two million plus packets.
>
> I've been wonderin' if anyone else had been seeing it....

Yup. As an example of what I mean by "blast", I get short periods of 
(likely spoofed) 6129 traffic followed by lots of normal stuff with an 
occasional single hit here and there. A "blast" from yesterday:

2004-01-02 15:25:06 24.200.77.210       6129    6       
2004-01-02 15:25:06 80.081.125.254      6129    6       
2004-01-02 15:25:07 24.3.127.085        6129    6       
2004-01-02 15:26:22 69.144.204.162      6129    6       
2004-01-02 15:27:15 80.239.41.48        6129    6       
2004-01-02 15:27:16 24.70.213.11        6129    6       
2004-01-02 15:28:57 24.127.169.144      6129    6       
2004-01-02 15:28:59 80.33.96.251        6129    6       
2004-01-02 15:29:22 24.64.125.101       6129    6       
2004-01-02 15:29:27 24.55.117.113       6129    6
2004-01-02 15:30:15 24.94.189.230       6129    6       
2004-01-02 15:30:15 24.42.53.119        6129    6       
2004-01-02 15:30:16 24.203.140.153      6129    6       
2004-01-02 15:30:42 24.193.166.42       6129    6       
2004-01-02 15:32:49 80.14.114.164       6129    6       
2004-01-02 15:32:51 69.139.158.165      6129    6       
2004-01-02 15:34:15 24.130.211.34       6129    6       
2004-01-02 15:34:34 68.65.36.214        6129    6       
2004-01-02 15:34:35 24.84.152.132       6129    6       
2004-01-02 15:36:18 24.202.114.152      6129    6       
2004-01-02 15:38:03 192.216.83.87       6129    6       
2004-01-02 15:40:06 218.108.254.61      6129    6       
2004-01-02 15:40:07 24.200.160.215      6129    6       
2004-01-02 15:40:09 24.48.151.18        6129    6       
2004-01-02 15:40:09 66.188.46.208       6129    6       
2004-01-02 15:41:54 68.144.128.218      6129    6       
2004-01-02 15:43:10 24.87.130.66        6129    6       
2004-01-02 15:43:32 24.6.159.140        6129    6       
2004-01-02 15:43:37 210.193.26.195      6129    6       
2004-01-02 15:44:17 24.88.134.190       6129    6
2004-01-02 15:46:42 24.193.93.205       6129    6       
2004-01-02 15:47:36 24.151.138.70       6129    6       
2004-01-02 15:48:35 24.83.173.125       6129    6       
2004-01-02 15:49:12 80.204.82.76        6129    6       
2004-01-02 15:49:58 24.157.4.185        6129    6       
2004-01-02 15:49:59 66.65.92.034        6129    6       
2004-01-02 15:51:07 24.131.248.232      6129    6       
2004-01-02 15:51:24 24.57.8.178 3       6129    6       
2004-01-02 15:51:52 24.169.56.121       6129    6       
2004-01-02 15:51:57 24.98.11.85         6129    6       
2004-01-02 15:52:40 24.47.246.123       6129    6       
2004-01-02 15:53:16 66.214.21.149       6129    6       
2004-01-02 15:54:17 64.94.199.9         6129    6       
2004-01-02 15:54:49 24.46.13.66         6129    6       
2004-01-02 15:55:35 69.139.147.196      6129    6       
2004-01-02 15:55:39 24.167.183.9        6129    6       
2004-01-02 15:55:55 24.5.172.219        6129    6       
2004-01-02 15:56:35 24.87.81.53         6129    6       
2004-01-02 15:56:39 24.192.213.215      6129    6       
2004-01-02 15:58:10 80.19.53.202        6129    6

-jim    

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html