RE: patternmatch for scan

[Martin Machacek <mm () i cz>]

On 19-Feb-00 Kenneth_W_Fox () sbphrd com wrote:
> Is anyone familiar with an attack or probe which begins or ends with scanning
> only ports 3128 & 8080 on a target box? I've been seeing alot of this lately
> in various places.

Yes, somebody is searching for open HTTP proxy. 3128 is default port for Squid
and 8080 is frequently used port for HTTP proxies.

        Martin 

---
[PGP KeyID F3F409C4]