On Sun, 23 Dec 2001, Matthew D. Close wrote:
> There seem to be two types of scanning going on, one that looks like
> scanssh. Then another that's a SYN scan, with a normal reconnect to
> port 22 if the first scan found anything open.
scanssh -p will do that, maybe that is what is going on:
-p ifaddr
Specifies the address of the local interface. This is used to
speed up the scanning by pre-probing the addresses with TCP-SYN
packets.
makes a massive performance enhancement.
____________________________
jose nazario joseat_private
PGP: 89 B0 81 DA 5B FD 7E 00 99 C3 B2 CD 48 A0 07 80
PGP key ID 0xFD37F4E5 (pgp.mit.edu)
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Fri Dec 28 2001 - 08:24:53 PST