Re: Another odd UDP scan - new trojan?

[pierre () DATARESCUE COM (Pierre Vandevenne)]

On Thu, 18 May 2000 11:32:52 +0100, Neil Long wrote:

> We just had a report which is unusual -
> UDP ports 33448 through 33453
> Scanning one of our net blocks but rolling the loop on the 3rd octet and
> throttled down to one every  second or so. Src port number constant per dest
> host but then changing on the next target ip.

It looks like a traceroute or the result of some code derived from
traceroute's (firewalk ?)

http://www.dislessici.org/info/firewalk-final.txt

Pierre


---
http://www.datarescue.com/idabase/ida.htm - IDA Pro 4.04 available
Alpha, Sparc, ARM, Intel & more interactive disassembler
http://www.acrypt.com - free crypto stuff there
http://www.datarescue.com/life - personal page