Fwd: Re: Part 2 Scanning on tcp port 27374

[l.m.d.cranswick () dl ac uk (Lachlan Cranswick)]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
UNSUBSCRIBE: email "unsubscribe ids" to majordomo () uow edu au

> [tcpdump -x 'port 27374']
> You should also run pktsuck or something to that extent to catch any
> data that the person in question might attempt to send once he realizes
> that this port is open and accepting connections.
> pktsuck is relativley easy to set-up and configure, and provides logging
> of data via the syslog facilities.

Do you have a web or ftp address for this pktsuch?

----

DTK Deception scripts might also help log what they could
be trying to do on that port as well.

http://www.all.net/dtk/

Lachlan.

Lachlan M. D. Cranswick

Collaborative Computational Project No 14 (CCP14)
     for Single Crystal and Powder Diffraction
Daresbury Laboratory, Warrington, WA4 4AD U.K
Tel: +44-1925-603703  Fax: +44-1925-603124
E-mail: l.cranswick () dl ac uk  Ext: 3703  Room C14
                            http://www.ccp14.ac.uk