Re: Traffic to UDP Port 80

[John Kristoff <jtk () DEPAUL EDU>]

On Fri, 26 Oct 2007 08:41:23 -0400
"Babb, Robert" <babbr () UNION EDU> wrote:

> I've seen a couple of instances where a MAC is sending huge amounts of traf=
> fic to a computer in the netherlands.  Source port always UDP 57xxx and the=
>  dest. port is always UDP port 80.  Has anybody else ever seen this?  Anybo=
> dy know what could cause it?

A Macintosh or a MAC address?  Not that it matters much, but yes this
sort of thing is not uncommon.  Are these hosts typically unix-based,
running SSH?  It's also not uncommon for an account to have been brute
forced whereupon a simple Perl-based UDP flooder is run from the account.

John