Security Incidents: Re: [Fwd: [fw-wiz] Specious network performance measurements.]

[JNelson () CMCCONTROLS COM (CL: Nelson, Jeff)]

I have also seen similar activity. Just the other day we were hit with one.
The alert came through as a potential UDP port scan. In looking at the
syslog I found that the destination ports were for 33434 and a bit above.

Robert Graham has some excellent information and this activity is included.
It is the result of traceroute scans. It seems a lot of companies use this
to determine response times to customers/consumers etc. The company that was
scanning us in this manner was as web-banner advertising company in Germany.

Check out Robert Graham's site. Lot's of really useful info there.

http://www.robertgraham.com

Cheers,

Jeff

> > > > > > > > > > > > > > > > > > > > > > > > > > <<<<<<<<<<<<<<<<<<<<<<<<<<
Jeffrey L. Nelson        | Cleveland Motion Controls
Network Manager          | 7550 Hub Parkway
                         | Cleveland, Ohio 44125
jnelson () cmccontrols com  | 216-642-5147
> > > > > > > > > > > > > > > > > > > > > > > > > > <<<<<<<<<<<<<<<<<<<<<<<<<<