Re: Port Zero
Andrew Simmons <[email protected]>
| Newsgroups | gmane.comp.security.incidents |
|---|---|
| Message-ID | <[email protected]> |
[email protected] wrote: > I had in incident yesterday (18 June 2005), I guess you meant July :) >where a client's Windows box listed almost every possible port as open, >listening in the same way described above. Similiar netstat -an output >as above. From my experience this isn't normal. > ditto > A few hours later the machine rapidly starting sending packets to > random addresses on port 443. > I guess you mean "apparently random" in that you couldn't see a pattern... were the IPs probed running HTTPS servers? Did you get a packet capture? Was there any other traffic from this machine - ICMP? \a (speaking for myself only) -- Andrew Simmons Technical Security Consultant MessageLabs Mobile: +44 (7917) 178745 [email protected] www.messagelabs.com MessageLabs - Be certain ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________