Snort mailing list archives
unusually high port scan activity
From: "Everist, Benjamin S. CTR (WHDB)" <benjamin.everist () navy mil>
Date: Mon, 12 Jan 2004 09:02:49 -0800
Just an FYI: I normally get about 3-5 port scans for port 554 (RTSCP/ Real Audio) per week, no big deal, this weekend I got 46. A little unusual there. I got a total of 61 distinct scans presumably from unique IP's. Other ports of interest were: 2, 1257, 1524, 3389, 4899, 8000, 14232, 17300, and 20168. If this mail comes PKI signed, you may get a warning about trusting the message originator, unless you have installed the DoD root certificates on your machine. Due to mail problems (on my end), I am not currently recieving messages from this list, so if for some reason you have a comment you want me to see, please cc me. R/ Benjamin Everist
Attachment:
smime.p7s
Description:
Current thread:
- unusually high port scan activity Everist, Benjamin S. CTR (WHDB) (Jan 13)