You might look at (and provide) what they're using for a "source" port - I've seen numerous "reverse http" and "reverse telnet" scans, where a source port of 80 or 23 is used. Such a approach could fool a stateless firewall or IDS. -g On Sun, 4 Nov 2001 bonkat_private wrote: > Anyone know what trojans/backdoors run on 22634, 24544 and 29319 ? > Snort.org doesn't list these. : : : > 22634 24.254.60.19 unknown Nov 3 23:49:26 > 22634 24.254.60.19 unknown Nov 3 23:48:26 > 22634 24.254.60.19 unknown Nov 3 23:47:26 > 22634 24.254.60.19 unknown Nov 3 23:46:26 > 22634 24.254.60.19 unknown Nov 3 23:45:26 > 22634 24.254.60.19 unknown Nov 3 23:44:26 > 22634 24.254.60.19 unknown Nov 3 23:43:26 > 22634 24.254.60.19 unknown Nov 3 23:42:26 > 22634 24.254.60.19 unknown Nov 3 23:41:53 > 22634 24.254.60.19 unknown Nov 3 23:41:36 > 22634 24.254.60.19 unknown Nov 3 23:41:28 Glenn Forbes Fleming Larratt Rice University Network Management glrattat_private ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Sun Nov 04 2001 - 19:36:02 PST