RE: reading signatures?

[kim () nhi no (Kim Robert Blix)]

> the end of it.  And it was fast, so it is obviously a script.  Here is a
> better example:
>
> 14:18:36.148999 x.x.x.x.9999 > x.x.x.0.53: 1205+ (45)
> 14:18:36.188602 x.x.x.x.9999 > x.x.x.0.53: 1205+ (45)
> 14:18:36.756601 x.x.x.x.9999 > x.x.x.255.53: 1205+ (45)
> 14:18:36.803255 x.x.x.x.9999 > x.x.x.255.53: 1205+ (45)

[snip]

2 things come to mind:

  covert data sent to a compromized service. not likly since there are no
response packets comming from your side.
 
  dns scanning, which seems more likly given that broadcast adresses are
used. 

if I where you I would get some more information though. I assue the
x.x.x.244.53 packets are udp, but are they all? Its fairly easy to
recognize a scan if you log tcp packets, flags and such give tell-tale
signs (not to mention the fact that tcp.id is 31337 :-P). Sniff the
packets to see what they contain.  

in short, you need to do some more digging.

k