Re: odd scans?

From: Matt Zimmerman (mdzat_private)
Date: Fri May 24 2002 - 12:13:02 PDT

  • Next message: Hugo van der Kooij: "continues SCAN Proxy attempt"

    On Fri, May 24, 2002 at 10:16:20AM -0700, Scott, Michael R. wrote:
    > Anyone recognize this or have a clue what they're looking for (covert
    > channel, root shell) or what tool is responsible?  The source and dest ports
    > are almost as randomly distributed across the high range as the location of
    > the source IPs are across the globe, but notice that the same two ack
    > numbers repeat across all the source IPs.
    Someone trying to brute-force reset a TCP connection by guessing?
     - mdz
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see:

    This archive was generated by hypermail 2b30 : Fri May 24 2002 - 13:09:03 PDT