UDP 22 & 5632

[Aaron Turner <aturner () vicinity com>]

I'm seeing a reoccuring pattern where a system will sequentially scan a
network over and over and over (sometimes for hours) trying to connect to
UDP 22 & 5632.  The source port is pretty static, always near (but higher
than) 1024.

Anyone with an idea of what this is?  It seems to be running on a Windows
(most likely NT since the IP is in a co-lo) system.

-- 
Aaron Turner        aturner () vicinity com  650.237.0300 x252
Security Engineer                         Vicinity Corp.        
Cell: 408-314-9874                        http://www.vicinity.com