RE: TCP port 5000 syn increasing

[Frank Knobbe <frank () knobbe us>]

On Tue, 2004-05-18 at 10:18, Paul Schmehl wrote:
> Of course with the cut and paste worms that are coming out these days,
> who 
> can say what it really might be?

That begs the question if it isn't becoming useless nowadays to count
port scans. Perhaps we should focus instead on catching the worms and
provide payload, or payload hashes. Otherwise, how would you pick up the
new strain of SQL slammer amongst all the existing SQL port scans?

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part