Re: Increased connects to Port 1433

From: Travis Pugh (tdpat_private)
Date: Tue May 21 2002 - 11:09:58 PDT

  • Next message: George Bakos: "Re: Strange scan on 1433"

    ----- Original Message -----
    From: "Keith T. Morgan" <keith.morganat_private>
    > We've seen a moderate increase for scans on port 1433.  We're up
    about 200%,
    > however the overall number of scans is small, so that percentage may
    be a little
    > misleading.  While scans are up, they don't appear to be at an
    alarming rate yet, at
    > least on any of our systems.
    I am seeing more than 200% at a medium-sized site.  From April 7th to
    May 20th, I recieved 17,168 individual scans stopped at the firewall.
    So far on May 21, I have recieved 27,400 scans.  I got 11,186 scans
    While still a rather small number for a couple of /24s, I'm curious to
    see if this thing has legs, and whether it will continue to grow
    quickly.  The scans initially appear to be coming from a relatively
    small number of sources (roughly 45), but they have increased a good
    deal from my perspective.
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see:

    This archive was generated by hypermail 2b30 : Tue May 21 2002 - 13:34:29 PDT