Snort mailing list archives
Re: Lots of outgoing portscans
From: Richard Gaywood <rich () fscked co uk>
Date: Wed, 22 Oct 2003 10:17:18 +0100
On Wed, 2003-10-22 at 08:28, Richard Gaywood wrote:
Hello list! Please forgive me posting without lurking first but I'm slightly panicked about this.
Actually, I've now resolved this: in addition to the connections on port 7, there were a bunch of them on port 2703 to some of the same hosts. Googling that revealed that this is from Razor, so I'm pretty sure now that these "scans" are SpamAssassin RBLing mail. I'm still confused why it's port 7 that's used, but I'm pretty satisfied there's nothing fishy going on. Sorry to waste people's time! -- Richard Gaywood <rich () fscked co uk> ------------------------------------------------------- This SF.net email is sponsored by OSDN developer relations Here's your chance to show off your extensive product knowledge We want to know what you know. Tell us and you have a chance to win $100 http://www.zoomerang.com/survey.zgi?HRPT1X3RYQNC5V4MLNSV3E54 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Lots of outgoing portscans Richard Gaywood (Oct 22)
- Re: Lots of outgoing portscans Richard Gaywood (Oct 22)
- Re: Lots of outgoing portscans Matt Kettler (Oct 22)