Re: UDP port 500 traffic from two clients

From: Gary Flynn (flynngnat_private)
Date: Mon Jan 28 2002 - 11:33:16 PST

Next message: Hugo van der Kooij: "Re: UDP port 500 traffic from two clients"

Previous message: McCammon, Keith: "RE: UDP port 500 traffic from two clients"
In reply to: Chris Wilkes: "UDP port 500 traffic from two clients"
Next in thread: Hugo van der Kooij: "Re: UDP port 500 traffic from two clients"
Reply: Hugo van der Kooij: "Re: UDP port 500 traffic from two clients"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Chris Wilkes wrote:
> 
> I recently moved and changed IP addresses within my ISP's block and two
> IP addresses from mediaone.net and home.com hit me a couple of times a
> minute with a UDP request to port 500.

Code Red and Nimda infected machines will reportedly generate port 
500 traffic.

-- 
Gary Flynn
Security Engineer - Technical Services
James Madison University

Please R.U.N.S.A.F.E.
http://www.jmu.edu/computing/runsafe

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Hugo van der Kooij: "Re: UDP port 500 traffic from two clients"
Previous message: McCammon, Keith: "RE: UDP port 500 traffic from two clients"
In reply to: Chris Wilkes: "UDP port 500 traffic from two clients"
Next in thread: Hugo van der Kooij: "Re: UDP port 500 traffic from two clients"
Reply: Hugo van der Kooij: "Re: UDP port 500 traffic from two clients"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Jan 28 2002 - 11:59:16 PST