Re: odd scans?

From: Matt Zimmerman (mdzat_private)
Date: Fri May 24 2002 - 12:13:02 PDT

Next message: Hugo van der Kooij: "continues SCAN Proxy attempt"

Previous message: Kyle R. Hofmann: "Re: odd scans?"
In reply to: Scott, Michael R.: "odd scans?"
Next in thread: Bamm (Robert) Visscher: "Re: odd scans?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Fri, May 24, 2002 at 10:16:20AM -0700, Scott, Michael R. wrote:

> Anyone recognize this or have a clue what they're looking for (covert
> channel, root shell) or what tool is responsible?  The source and dest ports
> are almost as randomly distributed across the high range as the location of
> the source IPs are across the globe, but notice that the same two ack
> numbers repeat across all the source IPs.

Someone trying to brute-force reset a TCP connection by guessing?

-- 
 - mdz

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Hugo van der Kooij: "continues SCAN Proxy attempt"
Previous message: Kyle R. Hofmann: "Re: odd scans?"
In reply to: Scott, Michael R.: "odd scans?"
Next in thread: Bamm (Robert) Visscher: "Re: odd scans?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri May 24 2002 - 13:09:03 PDT