Security Incidents mailing list archives

UDP scan?


From: joey () SILICONDEFENSE COM (Joe McAlerney)
Date: Thu, 11 May 2000 14:18:39 -0700


A flurry of 61 UDP packets were sent to a single host in about one
second.  I know of nothing special about the destination port range,
other than it lies in the range of source ports for traceroutes.  I
can't think of a way to relate that to this traffic.

Any thoughts?

-Joe M

May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33495 UDP
May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33496 UDP
May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33497 UDP
May 10 11:18:44 192.245.12.7:53 -> xxx.xxx.xxx.xxx:53 UDP
May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33465 UDP
May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33466 UDP
May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33467 UDP
May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33468 UDP
May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33469 UDP
May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33470 UDP
May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33471 UDP
May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33472 UDP
May 10 11:18:44 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33473 UDP
             .  .   .
May 10 11:18:45 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33522 UDP
May 10 11:18:45 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33523 UDP
May 10 11:18:45 192.245.12.7:50701 -> xxx.xxx.xxx.xxx:33524 UDP


Current thread: