Security Incidents mailing list archives
Re: Another odd UDP scan - new trojan?
From: pierre () DATARESCUE COM (Pierre Vandevenne)
Date: Thu, 18 May 2000 22:46:22 +0200
On Thu, 18 May 2000 11:32:52 +0100, Neil Long wrote:
We just had a report which is unusual - UDP ports 33448 through 33453 Scanning one of our net blocks but rolling the loop on the 3rd octet and throttled down to one every second or so. Src port number constant per dest host but then changing on the next target ip.
It looks like a traceroute or the result of some code derived from traceroute's (firewalk ?) http://www.dislessici.org/info/firewalk-final.txt Pierre --- http://www.datarescue.com/idabase/ida.htm - IDA Pro 4.04 available Alpha, Sparc, ARM, Intel & more interactive disassembler http://www.acrypt.com - free crypto stuff there http://www.datarescue.com/life - personal page
Current thread:
- Another odd UDP scan - new trojan? Neil Long (May 18)
- Re: Another odd UDP scan - new trojan? Pierre Vandevenne (May 18)
- Re: Another odd UDP scan - new trojan? Robert Graham (May 18)
- Re: Another odd UDP scan - new trojan? M J (May 19)