Re: odd scans?

[Matt Zimmerman <mdz () csh rit edu>]

On Fri, May 24, 2002 at 10:16:20AM -0700, Scott, Michael R. wrote:

> Anyone recognize this or have a clue what they're looking for (covert
> channel, root shell) or what tool is responsible?  The source and dest ports
> are almost as randomly distributed across the high range as the location of
> the source IPs are across the globe, but notice that the same two ack
> numbers repeat across all the source IPs.

Someone trying to brute-force reset a TCP connection by guessing?

-- 
 - mdz

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com