mailing list archives
Re: IDS logs showing outgoing packets on port 80
From: "Dude VanWinkle" <dudevanwinkle () gmail com>
Date: Sat, 3 Nov 2007 21:38:52 -0400
On 11/3/07, Kelly Robinson <caliana1989 () gmail com> wrote:
In our IDS logs, I notice many outgoing packets coming from port 80 (HTTP).
These packets are coming from client PCs. What may be happening?
If they are replies to an incoming packet, then they are running a web server.
If they are not replies to an incoming packet, they are most likely
infected and trying to evade IDS detection by using a standard port
(80) for C&C
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/