I pulled this data from a Proxy Server 2.0 Packet Filter log. What has me concerned is the seemingly random source and destination ports and in a few instances the source ports are low ports or, in one case, zero. I wouldn't think that streaming media would not hop ports like this. This happened multiple times for 30 seconds to a minute. The source IP was different each time, but it could have been spoofed. I have copied a segment of the log below. Note the Source Port = 0, seven lines from the bottom. I would appreciate any feedback on this. Thanks Josh Date Time Src IP Dest IP Proto SP DP Flags Frag Log Host ------------------------------------------------------------------------ --------------------------- 11/15/2001 10:54:45 a.b.c.188 w.x.y.34 Udp 11769 19892 - Frag w.x.y.34 - - 11/15/2001 10:54:45 a.b.c.188 w.x.y.34 Udp 13100 36866 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 60772 18235 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 2244 10919 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 38860 20639 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 44102 57112 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 36568 22795 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 829 35894 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 13590 37647 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 33653 11083 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 7771 18936 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 14726 58812 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 4688 54193 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 1991 21011 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 16453 45020 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 42955 9480 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 16725 11659 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 21637 51352 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 52265 54278 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 59684 10008 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 36361 12922 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 59164 41025 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 14928 35887 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 43540 56226 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 5571 40001 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 5808 37741 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 43092 4110 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 58173 65144 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 22068 51210 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 49295 49263 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 22098 42784 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 12549 47168 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 12920 632 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 29764 59286 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 62195 57409 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 11021 47211 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 19098 10409 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 51877 37582 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 63826 14992 - Frag w.x.y.34 - - 11/15/2001 10:54:46 a.b.c.188 w.x.y.34 Udp 4 38943 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 28770 54432 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 24934 42285 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 28911 49629 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 34631 14104 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 21288 1666 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 11473 14786 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 5007 10291 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 42505 5141 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 5565 59076 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 167 9472 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 14902 36368 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 54022 30931 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 34319 17895 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 59591 13377 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 46095 45974 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 17486 14882 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 57051 40017 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 50639 35439 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 62742 36349 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 39872 2108 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 45117 11241 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 0 62758 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 49560 17812 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 16902 36153 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 46173 47707 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 57613 21302 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 55572 44996 - Frag w.x.y.34 - - 11/15/2001 10:54:47 a.b.c.188 w.x.y.34 Udp 35904 41124 - Frag w.x.y.34 - - ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Nov 20 2001 - 11:53:29 PST