Re: patternmatch for scan

From: Chuck Swiger (chuckat_private)
Date: Tue Feb 22 2000 - 12:23:11 PST

Next message: Neil Ratzlaff: "iPlanet Webtop proxy"

Previous message: arkat_private: "Re: Recent Attacks"
Maybe in reply to: Kenneth_W_Foxat_private: "patternmatch for scan"
Next in thread: Neil Ratzlaff: "Re: patternmatch for scan"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Sat, 19 Feb 2000 08:56:21 -0500, Kenneth_W_Foxat_private wrote:
> Is anyone familiar with an attack or probe which begins or ends with
> scanning only ports 3128 & 8080 on a target box? I've been seeing alot of
> this lately in various places.

3128 is the default port used by the Squid web proxy; 8080 is another common  
port used either by a web server run by a normal user (as opposed to port  
80, which requires root) or as another common port for proxying.

-Chuck

       Chuck 'Sisyphus' Swiger | chuckat_private | Bad cop!  No Donut.
       ------------------------+-------------------+--------------------
       I know that you are an optimist if you think I am a pessimist....

Next message: Neil Ratzlaff: "iPlanet Webtop proxy"
Previous message: arkat_private: "Re: Recent Attacks"
Maybe in reply to: Kenneth_W_Foxat_private: "patternmatch for scan"
Next in thread: Neil Ratzlaff: "Re: patternmatch for scan"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:07:30 PDT