Re: NTP scan ????

From: Will Aoki (waokiat_private)
Date: Tue Feb 26 2002 - 17:52:45 PST

Next message: Joshua_Hillerat_private: "Re: "Nimda"?"

Previous message: Mally Mclane: "Re: Re[2]: Determining the country of orgin for IP address(es)"
In reply to: Russell Fulton: "NTP scan ????"
Next in thread: Russell Fulton: "Re: NTP scan ????"
Reply: Russell Fulton: "Re: NTP scan ????"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Wed, Feb 27, 2002 at 10:43:19AM +1300, Russell Fulton wrote:
> Just picked up a SYN scan for NTP.  There were problems with xntp a
> while back, I wonder if there is now an exploit out there...

I saw a SYN scan for port 123 from serv000.vj.worldonline.dk
(213.237.6.5) at 22:13 GMT-7 on the 20th, but I figured that it must
be something other than NTP, since AFAIK NTP only runs over UDP.

-- 
William Aoki     waokiat_private       /"\  ASCII Ribbon Campaign
3B0A 6800 8A1A 78A7 9A26 BB92              \ /  No HTML in mail or news!
9A26 BB92 6329 2D3E 199D 8C7B               X
                                           / \

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Joshua_Hillerat_private: "Re: "Nimda"?"
Previous message: Mally Mclane: "Re: Re[2]: Determining the country of orgin for IP address(es)"
In reply to: Russell Fulton: "NTP scan ????"
Next in thread: Russell Fulton: "Re: NTP scan ????"
Reply: Russell Fulton: "Re: NTP scan ????"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Feb 27 2002 - 10:02:29 PST