Re: High port UDP probe?

[mark () WHATNOT DEMON CO UK (Mark Rowe)]

In message <916B73552292D311B8AE0090277332B70AAE96@INFERNO>, Damian
Gerow <damian () ITACTICS COM> writes

This is most likely an automated scan looking for the trojan "Hack a
Tack". There are a number of web sites that maintain lists of common
Trojan/Backdoors and the TCP/UDP ports they use.

For example, http://www.onctek.com/trojanports.html

> Hash: SHA1
>
> This came up in our firewall:
>
> Apr 24 08:48:01 <hostname> kernel: Packet log: unserved DENY eth0
> PROTO=UDP 149.225.113.35:31790 xxx.xxx.xxx.xxx:31789 L=29:9 S=0x00
> I=64598 T=115
>
> What concerns me is both the destination port and the packet length.
> I'm assuming that L=29:9 means 29 for the whole packet size, and 9 is
> the UDP packet size.  Take away the UDP header, leaves you 1?  Am I
> reading this correctly?

--
Mark Rowe
IT Security Consultant
Xinetica
Email: mark.rowe () xinetica com