Security Incidents mailing list archives

Re: Increase seen in port probes since Tuesday afternoon

From: Martin Mačok <martin.macok () underground cz>
Date: Thu, 30 Dec 2004 21:44:30 +0100

On Thu, Dec 30, 2004 at 11:22:51AM +0200, BahdKo wrote:

Each probe involves the machine sending three packets to each port.


Which is default behaviour of Windows boxes - sending three SYN
packets close after each other even when the destination port is
reachable and closed (ie. responding with TCP RST).

Martin Mačok
IT Security Consultant

Current thread:

Increase seen in port probes since Tuesday afternoon BahdKo (Dec 30)
- RE: Increase seen in port probes since Tuesday afternoon M. Shirk (Dec 30)
- RE: Increase seen in port probes since Tuesday afternoon James C Slora Jr (Dec 30)
  - RE: Increase seen in port probes since Tuesday afternoon Michael (Dec 30)
  - Re: Increase seen in port probes since Tuesday afternoon Jeff Kell (Dec 31)
- Re: Increase seen in port probes since Tuesday afternoon Martin Mačok (Dec 30)