Re: Possible stacheldraht variant/probe

[spb () SCHADENFREUDE MESHUGGENEH NET (Stephen P. Berry)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I wrote:

> Is this a known (to everyone but me) variant of stacheldraht, or is
> this new behaviour?

The former.

The tool in question appears to have been dds, which looks for
trinoo, TFN and stacheldraht agents.  You can get the source at:

        http://staff.washington.edu/dittrich/misc/ddos_scan.tar

- -Steve

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE4o09IG3kIaxeRZl8RAluVAKDOwc9zfWZpVQHMRfHK9RAOOAMQCQCeJZKk
y3V4KnAm8LF04j50llWBOJw=
=4C5Y
-----END PGP SIGNATURE-----