Security Incidents mailing list archives

why 1548?

From: T_Esting () EXCITE COM (T.Esting)
Date: Wed, 2 Feb 2000 15:43:18 -0800

  So I'm looking through daily logs and I notice more than a few packets
destined for port 1548.  With all the noise we typically see, this stuff has
a way of looking like chaff rather than wheat, but I figured I'd dump a
month's worth and it turns out that we see 79 of them interspersed
throughout the days.  Interestingly, they all seem to be bounced/sourced off
some well-known service (IRC, telnet, ftp, etc.).  Unfortunately, I don't
get flags so I don't know if they're just SYN and spoofed or SYN-ACK or
RST-ACK and we're the decoy address.  Anyone else seeing these?  I haven't
exhausted all possibilities yet, but none of the usual suspects report
anything interesting to be found on port 1548.

BLOCK SRC XYZ.W59.0.90 S-PORT: 6667 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W49.31.17 S-PORT: 113 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W69.0.14 S-PORT: 113 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W4.110.46 S-PORT: 113 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W0.135.130 S-PORT: 113 DST: SO.ME.NET.25 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W49.31.17 S-PORT: 113 DST: SO.ME.NET.25 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W4.52.220 S-PORT: 6667 DST: SO.ME.NET.119 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W29.143.40 S-PORT: 113 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W9.28.99 S-PORT: 113 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W69.0.14 S-PORT: 113 DST: SO.ME.NET.25 D-PORT: 1548 PROTO: TCP
BLOCK SRC XYZ.W4.110.46 S-PORT: 113 DST: SO.ME.NET.25 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W29.143.40 S-PORT: 113 DST: SO.ME.NET.25 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W4.110.46 S-PORT: 113 DST: SO.ME.NET.72 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W0.135.130 S-PORT: 113 DST: SO.ME.NET.119 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W29.143.40 S-PORT: 113 DST: SO.ME.NET.72 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W0.135.130 S-PORT: 113 DST: SO.ME.NET.38 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W29.143.40 S-PORT: 113 DST: SO.ME.NET.119 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W87.141.192 S-PORT: 113 DST: SO.ME.NET.119 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W35.0.14 S-PORT: 80 DST: SO.ME.NET.106 D-PORT: 1548 PROTO: TCP
BLOCK SRC XYZ.W74.51.35 S-PORT: 23 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W6.130.149 S-PORT: 80 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W43.35.1 S-PORT: 6667 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W7.190.131 S-PORT: 139 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W98.1.3 S-PORT: 113 DST: SO.ME.NET.106 D-PORT: 1548 PROTO: TCP
BLOCK SRC XYZ.W29.143.40 S-PORT: 113 DST: SO.ME.NET.25 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W29.143.40 S-PORT: 113 DST: SO.ME.NET.72 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W59.0.90 S-PORT: 6667 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W59.0.90 S-PORT: 6664 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W66.195.4 S-PORT: 80 DST: SO.ME.NET.25 D-PORT: 1548 PROTO: TCP
BLOCK SRC XYZ.W66.195.4 S-PORT: 80 DST: SO.ME.NET.85 D-PORT: 1548 PROTO: TCP
BLOCK SRC XYZ.W09.72.24 S-PORT: 139 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W09.72.24 S-PORT: 139 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W59.0.90 S-PORT: 6667 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W22.30.240 S-PORT: 113 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W38.5.1 S-PORT: 113 DST: SO.ME.NET.106 D-PORT: 1548 PROTO: TCP
BLOCK SRC XYZ.W84.139.199 S-PORT: 113 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W64.126.100 S-PORT: 80 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W01.94.241 S-PORT: 9 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W01.94.241 S-PORT: 7 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W14.0.22 S-PORT: 9 DST: SO.ME.NET.106 D-PORT: 1548 PROTO: TCP
BLOCK SRC XYZ.W85.97.75 S-PORT: 139 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W59.0.90 S-PORT: 113 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W59.0.90 S-PORT: 666 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W59.0.90 S-PORT: 6667 DST: SO.ME.NET.25 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W5.57.193 S-PORT: 9 DST: SO.ME.NET.106 D-PORT: 1548 PROTO: TCP
BLOCK SRC XYZ.W5.57.193 S-PORT: 110 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W5.57.193 S-PORT: 21 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W05.165.203 S-PORT: 9 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W05.165.203 S-PORT: 7 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W05.165.203 S-PORT: 21 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W05.165.203 S-PORT: 110 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W05.165.203 S-PORT: 53 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W05.165.203 S-PORT: 113 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W05.165.203 S-PORT: 80 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W05.165.203 S-PORT: 138 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W05.165.203 S-PORT: 23 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W05.165.203 S-PORT: 139 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W59.0.90 S-PORT: 113 DST: SO.ME.NET.85 D-PORT: 1548 PROTO: TCP
BLOCK SRC XYZ.W59.0.90 S-PORT: 6667 DST: SO.ME.NET.85 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W09.17.199 S-PORT: 1434 DST: 192.216.187.11 D-PORT: 1548
PROTO: TCP
BLOCK SRC XYZ.W52.95.11 S-PORT: 21 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W52.95.11 S-PORT: 23 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W59.98.133 S-PORT: 7 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W6.97.35 S-PORT: 6667 DST: SO.ME.NET.25 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W6.97.35 S-PORT: 6667 DST: SO.ME.NET.119 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W14.22.99 S-PORT: 25 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W6.97.35 S-PORT: 6667 DST: SO.ME.NET.51 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W28.128.18 S-PORT: 23 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W28.128.18 S-PORT: 138 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W28.128.18 S-PORT: 53 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W2.36.136 S-PORT: 110 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W6.97.35 S-PORT: 6667 DST: SO.ME.NET.38 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W6.97.35 S-PORT: 6667 DST: SO.ME.NET.85 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W8.252.197 S-PORT: 139 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W52.95.11 S-PORT: 21 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W53.153.153 S-PORT: 7 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W53.153.153 S-PORT: 138 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W76.114.21 S-PORT: 138 DST: SO.ME.NET.106 D-PORT: 1548 PROTO:
TCP
BLOCK SRC XYZ.W6.97.35 S-PORT: 6667 DST: SO.ME.NET.4 D-PORT: 1548 PROTO: TCP

_______________________________________________________
Get 100% FREE Internet Access powered by Excite
Visit http://freeworld.excite.com
Current thread:

Re: R: Re: Korea (was RE: ?) Jordan Ritter (Jan 31)
- Re: R: Re: Korea (was RE: ?) thomas lakofski (Feb 01)
  - Re: R: Re: Korea (was RE: ?) Jordan Ritter (Feb 02)
  - why 1548? T.Esting (Feb 02)