Snort mailing list archives

unusually high port scan activity


From: "Everist, Benjamin S. CTR (WHDB)" <benjamin.everist () navy mil>
Date: Mon, 12 Jan 2004 09:02:49 -0800

Just an FYI:

I normally get about 3-5 port scans for port 554 (RTSCP/ Real Audio) per
week, no big deal, this weekend I got 46.  A little unusual there.  I
got a total of 61 distinct scans presumably from unique IP's.  Other
ports of interest were: 2, 1257, 1524, 3389, 4899, 8000, 14232, 17300,
and 20168.

If this mail comes PKI signed, you may get a warning about trusting the
message originator, unless you have installed the DoD root certificates
on your machine.

Due to mail problems (on my end), I am not currently recieving messages
from this list, so if for some reason you have a comment you want me to
see, please cc me.


R/

Benjamin Everist

Attachment: smime.p7s
Description:


Current thread: