Re: Broadcast storm in my network/ any ideas

[3APA3A <3APA3A () SECURITY NNOV RU>]

Dear wilder_jeff Wilder,

UDP/111  (Sun  RPC)  is  not used in Windows environment. Either you use
some services for Unix, i.e. MS services for Unix, 3rd party NFS/NIS/etc
support or this is result of privileged user/trojan/backdoor activity.

--Thursday, December 22, 2005, 8:16:48 PM, you wrote to full-disclosure () lists grok org uk:


wW> I  have  a Windows 2000 terminal server that is consistantly sending
wW> out  broadcasts  to 255.255.255.255:111... below is a capture from a
wW> RPC     portmap     proxy     attempt    UDP    10.74.32.31:3300/udp
wW> 255.255.255.255:111/udp  07:50:35  RPC  portmap  proxy  attempt  UDP
wW> 10.74.32.31:3291/udp 255.255.255.255:111/udp 07:50:05

-- 
~/ZARAZA
http://www.security.nnov.ru/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/