NT Compromise -- Update -- SRC PORT: 53 traffic

[Loki <loki () fatelabs com>]

I should mention that the packets were flooding our DNS server, enough
traffic to saturate and bring down our T1. Please note that again, the
port 53 was not the DST port, rather, the SRC port of each packet.


-- 


============================================================
Loki
Founder, Chief Research Scientist
Fate Research Labs
United States VPN Division
------------------------------------------------------------
[w] http://www.fatelabs.com
[e] loki () fatelabs com
[p] +1 412 303 3115
------------------------------------------------------------
"Ipsa Scientia Potestas Est" Knowledge itself is power.
============================================================


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com