Re: SQL port probe repeats

From: Harlan S. Barney, Jr. (hsbarneyat_private)
Date: Sat Jun 22 2002 - 18:34:22 PDT

Next message: Bill Royds: "Unusual proxy port scan"

Previous message: KF: "Re: Ending a few arguments with one simple attachment."
In reply to: Brian Collins: "port 32814"
Next in thread: David Barnett: "Re: SQL port probe repeats"
Reply: David Barnett: "Re: SQL port probe repeats"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

After about 250 SQL port probes to my workstation without a repeat of
source IP, I have found two repeats in the last week.  One was from
Korea, the other from the USA.

Maybe someone cleaned the two systems but did not secure them properly.

I have also noted that in March I had a SQL port probe followed by an
FTP port probe from the same source in France.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Bill Royds: "Unusual proxy port scan"
Previous message: KF: "Re: Ending a few arguments with one simple attachment."
In reply to: Brian Collins: "port 32814"
Next in thread: David Barnett: "Re: SQL port probe repeats"
Reply: David Barnett: "Re: SQL port probe repeats"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sat Jun 22 2002 - 21:41:58 PDT