Re: TCP port 5000 syn increasing

[Valdis.Kletnieks () vt edu]

On Tue, 18 May 2004 13:45:50 CDT, Frank Knobbe said:

> That begs the question if it isn't becoming useless nowadays to count
> port scans. Perhaps we should focus instead on catching the worms and
> provide payload, or payload hashes. Otherwise, how would you pick up the
> new strain of SQL slammer amongst all the existing SQL port scans?

I'm waiting for the first worm that tunnels over HTTP port 80, as a number
of protocols already do, to get around firewalls that only pass 25 and 80. ;)

Attachment: _bin
Description: