Re: CR Overflows followed up by UDP 2380

From: Alfred Huger (ahat_private)
Date: Mon Aug 06 2001 - 10:11:35 PDT

Next message: Kee Hinckley: "Re: How to obtain a complete list of CR2 compromised hosts"

Previous message: Gary Flynn: "Re: PWS was: CodeRedII attempts from Cable/DSL/dial-ups"
In reply to: Thompson, John J: "CR Overflows followed up by UDP 2380"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Mon, Aug 06, 2001 at 09:06:19AM -0500, Thompson, John J wrote:
> Anyone know what 2380 is and why there's a ten count of udp probes to it
> following almost every cr attempt? 2380 is unassigned according to my
> reference lists. 

Sun WebServer Admin Tool listens to port 2380. So does the BareView
server (whatever that is - see www.barefootsoft.com).

> John
> 
> ------------------------------------
> John Thompson
> Network Administrator
> Dept. of Biochemistry
> University of Iowa

-- 
VP Engineering
SecurityFocus.com
"Vae Victis"

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Kee Hinckley: "Re: How to obtain a complete list of CR2 compromised hosts"
Previous message: Gary Flynn: "Re: PWS was: CodeRedII attempts from Cable/DSL/dial-ups"
In reply to: Thompson, John J: "CR Overflows followed up by UDP 2380"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Aug 06 2001 - 11:02:08 PDT