Security Incidents mailing list archives

high activity on port 3061 udp/tcp


From: Marcelo Bartsch <mbartsch () netglobalis net>
Date: 06 Dec 2002 18:25:49 -0300

Hello
Does anyone has seen an increase of activity on port 3061 tcp and udp?

today i register at least 5000 drops on my firewall just today ,all of
the has the same ip as target.

some part of the logs
Dec  6 18:21:50 fw-int kernel: UDP DROP (global REJECT): IN=eth2
OUT=eth0 SRC=200.30.216.98 DST=XXX.XX.XX.XXX LEN=70 TOS=0x00 PREC=0x00
TTL=122 ID=61524 PROTO=UDP SPT=2189 DPT=3061 LEN=50

SRC Address are multiple ones


-- 
   Marcelo Bartsch
mbartsch () netglobalis net
  www.netglobalis.net

PGP Fingerprint : 
877E 3A56 F523 B44A 3260  8F83 8916 E158 6100 F721


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com


Current thread: