Big traffic on 412/tcp

From: Guido Van De Velde (Guido.VanDeVeldeat_private)
Date: Wed Apr 24 2002 - 01:43:20 PDT

Next message: gregory.kaneat_private: "ftp"

Previous message: Jason Robertson: "Rootkit or trojan"
Next in thread: Ian Stoba: "Re: Big traffic on 412/tcp"
Reply: Ian Stoba: "Re: Big traffic on 412/tcp"
Reply: H C: "Re: Big traffic on 412/tcp"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

We see here in our Cisco netflow data quite a large amount of data 
coming from 412/tcp (about 20 gbyte/day, about 1/8 of our http data). 
It seem to me that the official use, synoptics-trap, isn't that used, or 
am I wrong.

Does anyone know what they transport on this port ?

TIA
-- 
guido


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: gregory.kaneat_private: "ftp"
Previous message: Jason Robertson: "Rootkit or trojan"
Next in thread: Ian Stoba: "Re: Big traffic on 412/tcp"
Reply: Ian Stoba: "Re: Big traffic on 412/tcp"
Reply: H C: "Re: Big traffic on 412/tcp"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Apr 24 2002 - 09:16:47 PDT