Security Incidents mailing list archives

Unknown traffic


From: phancock () LIB CI PHOENIX AZ US (Paul Hancock)
Date: Tue, 27 Jun 2000 08:41:35 -0700


There is a system that is trying to connect to udp ports 55559, 43768, and
54253 on a number of my systems.  It tries those ports on a given machine,
and then moves on to a seemingly random machine from within my network.
Any idea what is running, or what it is trying to connect to?

[IPs changed]

Jun 27 02:10:26 ppl 74081: %SEC-6-IPACCESSLOGP: list PPL-COPATM-in denied
udp 8.1.218.40(2753) -> 207.137.123.164(55559), 1 packet
Jun 27 02:10:27 ppl 74082: %SEC-6-IPACCESSLOGP: list PPL-COPATM-in denied
udp 8.1.218.40(2754) -> 207.137.123.164(43768), 1 packet
Jun 27 02:10:28 ppl 74083: %SEC-6-IPACCESSLOGP: list PPL-COPATM-in denied
udp 8.1.218.40(2755) -> 207.137.123.164(54253), 1 packet

                -- Paul (phancock () lib ci phoenix az us)


Current thread: