Re: Lengthy probes of port 8500

From: Soeren Ziehe (robintonat_private)
Date: Thu Sep 06 2001 - 03:25:00 PDT

Next message: Todd Ransom: "Re: Strange traffic"

Previous message: Jens Hektor: "Re: Strange traffic"
In reply to: Paul Gear: "Lengthy probes of port 8500"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

In article <3B95D970.C9982F62at_private> [05 Sep 01]
   Paul Gear  <paulat_private> wrote:

> Has anyone seen probes like this in the last few days?  I've never
> seen them before, then last night i got more than 300 attempts in a
> little over 2 hours.

> Sep  4 18:53:39 xxx kernel: Packet log: input DENY ppp0 PROTO=6
> a.a.30.66:1761 x.x.16.93:8500 L=48 S=0x00 I=65349 F=0x4000 T=117
> SYN (#67)

I haven't seen probes for that port, but I can shed some light onto what  
this may be, I guess.

Port 8500 is the standard port for the "gatherd" component of the  
"harvest" distributed search engine/network.

Robinton

-- 
Fuer das grosse Chaos haben wir Computer.
Die uebrigen Fehler machen wir von Hand.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Todd Ransom: "Re: Strange traffic"
Previous message: Jens Hektor: "Re: Strange traffic"
In reply to: Paul Gear: "Lengthy probes of port 8500"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Sep 06 2001 - 08:07:47 PDT