RE: postscan

["Paul Melson" <pmelson () gmail com>]

Yes, though what you describe is probably not p2p software and is more
likely Windows Messenger "spam" attempts.

http://isc.sans.org/port_details.php?port=1026

PaulM

-----Original Message-----
Subject: Re: [Snort-users] postscan

Are they likely to fire decoy detection rules?

I infer a lot of decoyed traffic to 1026/UDP and 1027/UDP from the number of
ICMP Unreach messages I've been receiving in which the original datagram src
IP was forged (to one of my addresses).




-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users