Re: Lots and lots of DNS lookups and increased number of /default.ida?XXXXXXXXXXXXXXXXXXXXXXXX...s

[John Conover <conover () rahul net>]

Many-about 2X to 5X as many. Mine are to port 53 TCP, no SYN.

About double to port 80, with SYN.

        John

Fred Cohen writes:
> I seem to be seeing very large numbers of DNS lookups and lots of
> apparent /default.ida?XXXXXXXXXXXXXXXXXXXXXXXX...  lookups from my class
> B as of the last hour or so. 
>
> Anyone else?
-- 

John Conover        Tel. 408.370.2688  conover () rahul net
631 Lamont Ct.      Fax. 408.379.9602  http://www.johncon.com/
Campbell, CA 95008  Cel. 408.772.7733  


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com