Re: Strange portscan traffic with dest of 169.254.x.x

["Paul Melson" <pmelson () gmail com>]

> It's odd for a couple reasons.  First, why is 169.254 traffic even getting
routed to our 
> external firewall.  This is probably something I need to discuss with our
network admin.  That 
> just seems weird to me.  Second, if I am reading the alert correctly, it
looks like the 
> computer is scanning itself for NetBIOS and SMB ports.  I was just
wondering if anyone else 
> has seen anything like this.

Yes, the cause in my case was the roll-out of ActiveSync 4.x.

PaulM


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users