Re: Port 33434 and decoy-scanning

[clem () CLEM DIGITAL NET (Pete Clements)]

Quoting Jan Roger Wilkens
  > Lately I have seen traffic towards port 33434 UDP on various networks.
  > Normal traceroute starts with port 33434, but the destination-port is
  > supposed to increase with each new packet. The traffic I've seen lately uses
  > port 33434 as destionation-port for all packets.
  >

Don't know the what or why but have been seeing the same traffic for
about week, same source addresses.  The source ports are the same each
pass, and occurs about the same time each day for a period of an hour or
so.  The pattern is traceroute like, generally 3 packets with TTL=1 followed
by 1 to 3 packets with TTL=2.

--
Pete Clements
clem () clem digital net