On Wed, 2002-02-27 at 14:52, Will Aoki wrote: > On Wed, Feb 27, 2002 at 10:43:19AM +1300, Russell Fulton wrote: > (213.237.6.5) at 22:13 GMT-7 on the 20th, but I figured that it must > be something other than NTP, since AFAIK NTP only runs over UDP. Possibly but tcp-123 is reserved for NTP... Another thought that occurred to me was that it was a typo and they meant to scan for 1234 or 12345, both popular trojan ports, This seems unlikely since it would appear that this wasn't a single scan. -- Russell Fulton, Computer and Network Security Officer The University of Auckland, New Zealand ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Feb 27 2002 - 16:40:41 PST