Re: Part 2 Scanning on tcp port 27374

[dgailey () insync net (DPG)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au
Also, set-up tcpdump to listen for any traffic specified for those ports
see if it sent any data within the packet, and what flag bits where set
etc..
[tcpdump -x 'port 27374']
You should also run pktsuck or something to that extent to catch any
data that the person in question might attempt to send once he realizes
that this port is open and accepting connections.
pktsuck is relativley easy to set-up and configure, and provides logging
of data via the syslog facilities.

-dpg

.                                                 .
                        . 

             
                                       
        
                             

   
                                  .