Re: patternmatch for scan

From: Neil Ratzlaff (neil.ratzlaffat_private)
Date: Tue Feb 22 2000 - 12:48:34 PST

Next message: Philip J. Koenig: "Re: Recent Attacks"

Previous message: Thang T. Mai: "Re: packets"
Maybe in reply to: Kenneth_W_Foxat_private: "patternmatch for scan"
Next in thread: Cliff Rayman: "Re: patternmatch for scan"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

For the last several months there has been a pattern of scans for http, 
3128, and 8080.
http://www.sans.org/y2k/proxy.htm has a brief comment.

Neil

At 08:56 02/19/00 -0500, Kenneth_W_Foxat_private wrote:
>Is anyone familiar with an attack or probe which begins or ends with scanning
>only ports 3128 & 8080 on a target box? I've been seeing alot of this 
>lately in
>various places.
>
>Ken
>

Next message: Philip J. Koenig: "Re: Recent Attacks"
Previous message: Thang T. Mai: "Re: packets"
Maybe in reply to: Kenneth_W_Foxat_private: "patternmatch for scan"
Next in thread: Cliff Rayman: "Re: patternmatch for scan"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:07:36 PDT