Re: new/old port 135 scans?

[Brian Eckman <eckman () umn edu>]

Brian Collins wrote:
> Tonight we're seeing a significant increase in scans on tcp/135.  
> Customers are sending roughly 20 packets to several incremental IPs in a 
> class C, waiting 2 seconds, sending roughly 20 more, etc.  I was under 
> the impression that Blaster/Nachi was programmed to cease as of 1/1/04 
> (of course, I could be wrong about that).    I'll try to have some 
> packets available in a little while.  In the meantime, has anyone else 
> noticed an increase?

That is exactly what Blaster does. It has not ceased, and probably won't 
for years. There should be an increase in it, as it no longer has Nachi 
trying to eradicate it.

Brian

--
Brian Eckman
Security Analyst
OIT Security and Assurance
University of Minnesota


"There are 10 types of people in this world. Those who
understand binary and those who don't."


---------------------------------------------------------------------------
----------------------------------------------------------------------------