You could have had a previous block of IP's that once had a half-life
server or someone connected to Gamespy from your network
Bill James
The objective of all dedicated employees should be to thoroughly analyze
all situations, anticipate all problems prior to their occurrence, have
answers for these problems, and move swiftly to solve these problems
when called upon.
However, When you are up to your ass in alligators it is difficult to
remind yourself your initial objective was to drain the swamp.
> -----Original Message-----
> From: firewall-wizards-admin_at_honor.icsalabs.com
> [mailto:firewall-wizards-admin_at_honor.icsalabs.com] On Behalf
> Of hermit921
> Sent: Friday, January 02, 2004 12:59 PM
> To: firewall-wizards_at_honor.icsalabs.com
> Subject: Re: [fw-wiz] port 27015
>
> I am aware of the Half-Life game association. What I saw was
> 10 different IP sources scanning my entire class B on port
> 27015, all starting within one hour of each other. That
> didn't sound like a normal game behavior. But after that
> day, the scans didn't return.
>
> hermit921
>
>
> At 02:15 PM 1/1/2004, Don Parker wrote:
> >Hi there, port 27015 is often associated with Half Life
> online gaming
> >servers. Are you running one of these? There are some security
> >considerations to mull over if you are as these can be used in DDoS
> >attacks and the such. Just google for "port 27015 tcp" and
> you will get
> >quite a few hits on it.
> >
> >Cheers,
> >
> >Don
> >
> >-------------------------------------------
> >Don Parker, GCIA
> >Intrusion Detection Specialist
> >Rigel Kent Security & Advisory Services Inc
> www.rigelksecurity.com ph
> >:613.249.8340
> >fax:613.249.8319
> >--------------------------------------------
> >
> >On Dec 22, hermit921 <hermit921_at_yahoo.com> wrote:
> >
> >Starting at 10:49 UTC December 22 I started seeing a 20-30 incoming
> >packets per second on TCP port 27015. Every few minutes
> another source
> >appeared. Any idea what is going on?
> >
> >Thanks,
> >hermit921
> >
> >_______________________________________________
> >firewall-wizards mailing list
> >firewall-wizards_at_honor.icsalabs.com
> ><a href='http://honor.icsalabs.com/mailman/listinfo/firewall-
> >wizards'>http://honor.icsalabs.com/mailman/listinfo/firewall-
> wizards</a
> >>
>
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards_at_honor.icsalabs.com
> http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
_______________________________________________
firewall-wizards mailing list
firewall-wizards_at_honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
Received on Jan 03 2004
Intro
