NewOak?

[Dante Mercurio <Dante () WEBCTI COM>]

While going through a customers firebox logs, I noticed some strange
activity that I could not explain. For a period of 15 minutes approx. 100
different hosts attempted to connect to one box on port 28800/udp. Some of
those systems also attempted to connect on port 4001/udp which I show listed
as NewOak. (?)

Any clarification as to what was attempted? Since it came from so many
hosts, was it a DDOS on that port? I saw one reference to port 28800 as some
sort of gaming port, but I could not find it again to verify.


M. Dante Mercurio, CCNA, MCSE+I, TNSP
Consulting Services Manager
Continental Consulting Group, LLC

 <http://www.ccgsecurity.com/> www.ccgsecurity.com

 <mailto:dmercurio () ccgsecurity com> dmercurio () ccgsecurity com