Home page logo
/

basics logo Security Basics mailing list archives

Re: Strange Connection Attempts
From: Charles Hamby <fixer () gci net>
Date: Tue, 18 Feb 2003 18:50:19 -0900

I've been seeing 17300 scans from many places outside of Asia, actually.
I just had one today that I traced back to somewhere around LA, so they
definitely are getting to other time zones, I've been seeing scans from
Comcast, AT&T, and a couple of others.  But, as you say, in all of the
packets I've captured, none of them have any payload.  It's a little
odd.


-CDH
-----Original Message-----
From: Kinsey, Robert [mailto:Robert.Kinsey () Veridian com] 
Sent: Monday, February 17, 2003 2:39 PM
Cc: 'security-basics () securityfocus com '
Subject: RE: Strange Connection Attempts

I also saw the 17300 (which is the port Kuang 2 the virus runs on).  But
they were all coming from Asia (about 0800 their time) and never
progressed.
I was thinking it was a launch attempt on the 14th but no other TZs
showed
up.

My feeling is if these are all 0-byte length probes they aren't doing
much.
Just ensure these ports / services are set to drop the connections
fitting
the description.

rk


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault