portscan on tcp ports 1024 to 1280

From: Fletcher Mattox (fletcherat_private)
Date: Wed Oct 17 2001 - 10:05:39 PDT

Next message: Tina Bird: "[logs] Log Parsing Tools"

Previous message: Markus De Shon: "New email worm DarkMachine"
Next in thread: Joshua_Hillerat_private: "Re: portscan on tcp ports 1024 to 1280"
Reply: Joshua_Hillerat_private: "Re: portscan on tcp ports 1024 to 1280"
Reply: dr john halewood: "Re: portscan on tcp ports 1024 to 1280"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

What application or exploit probes every tcp port between 1024 and 1280
(i.e. 256 different ports in random order).  The source port is always
80 or 0.  Every host on our network is being scanned in this manner from
several different places.  Some source ip addresses are:

65.203.157.138
65.203.157.29
66.150.15.150
209.15.44.204

Thanks
Fletcher

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Tina Bird: "[logs] Log Parsing Tools"
Previous message: Markus De Shon: "New email worm DarkMachine"
Next in thread: Joshua_Hillerat_private: "Re: portscan on tcp ports 1024 to 1280"
Reply: Joshua_Hillerat_private: "Re: portscan on tcp ports 1024 to 1280"
Reply: dr john halewood: "Re: portscan on tcp ports 1024 to 1280"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Oct 17 2001 - 10:09:40 PDT