Re: [logs] Re: Reliably detecting things like the SQL worm....

Previous message: Nate Campi: "Re: [logs] Re: Reliably detecting things like the SQL worm...."
In reply to: H C: "Re: [logs] Re: Reliably detecting things like the SQL worm...."
Next in thread: Rainer Gerhards: "RE: [logs] Re: Reliably detecting things like the SQL worm...."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

martinat_private

Unfortunately, 1434 is a perfectly valid "ephemeral" port.  Would you
like, for instance, random DNS failures?

Martin

H C wrote:
> 
> Hear, hear!
> 
> > Rather, I'd say that you need to stay on top of
> > security; anybody
> > who had any MS-SQL servers anywhere approaching
> > visible from the
> > internet wasn't paying attention to basics.
> 
> If someone can post a valid, documented business
> reason for having UDP 1434 on a SQL server visible
> from the Internet, and NOT accessible behind a
> firewall/VPN, I'd love to see it!
> 
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
> http://mailplus.yahoo.com
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysisat_private
> http://lists.shmoo.com/mailman/listinfo/loganalysis
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis