Hum .. I just found a bunch of 27374 on one of my SDSL link with a few of
the 12345 scans. This link's firewall is allways way more active. My second
is an ADSL and it's usually quieter, this one has no 12345 but a few 27374.
Gary B
At 11:08 AM 8/12/2002 -0500, Preston Kutzner wrote:
>Hello Rob,
>
>Sunday, August 11, 2002, 8:42:50 AM, you wrote:
>
>RK> Anyone else seeing a huge increase in subseven scans...6708 since about
>RK> 0300Z - across all of my class C's and from quite a few sources
>(running the
>RK> query now to see how many).
>
>RK> Rob
>
>
>RK>
>----------------------------------------------------------------------------
>RK> This list is provided by the SecurityFocus ARIS analyzer service.
>RK> For more information on this free incident handling, management
>RK> and tracking system please see: http://aris.securityfocus.com
>
>I've seen quite a bit of traffic on ports tcp/12345 and tcp/27374.
>According to what I've seen, 27374 is a port used by quite a few
>versions of SubSeven, as for 12345, it's not mentioned that subseven
>runs on that port (that I've seen), but I am seeing attempted
>connections to these ports at the same time (maybe some other vuln
>attempt I'm not aware of? anyone?). Hope that helps.
>
>--
>Preston Kutzner | IT Manager
>Marketing Resources, Inc.
>
>_________________________________________________________________
>The information transmitted is intended only for the person or entity to
>which it is addressed and may contain confidential and/or privileged
>material. Any review, retransmission, dissemination or other use of, or
>taking of any action in reliance upon, this information by persons or
>entities other than the intended recipient is prohibited. If you received
>this in error, please contact the sender and delete the material from any
>computer.
>
>
>----------------------------------------------------------------------------
>This list is provided by the SecurityFocus ARIS analyzer service.
>For more information on this free incident handling, management
>and tracking system please see: http://aris.securityfocus.com
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
Received on Aug 12 2002
Intro
