Re: Port 44916 Scans
Ken Connelly <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
That port hasn't made my top-25 list in the past week, nor my top-10 list anytime this year. Sorry... -ken Mike Rabinowitz wrote: >Hi all, > >Anyone seen scans for tcp 44916? I haven't been able to dig anything up on this. No trace included here, but I'll give you the general idea: > >*Packets are always flagged with SYN just trying to initiate connection >*TCP retries are normal with 0, 3, 6 second intervals before giving up >*Sources seem to have nothing in common save for the fact that they are dial-ups or home dsl's. > >I can barely find anything about this port except for on Kurt Siegfield's pages stating that this should be the starting high source client port for Linux Fedora. > >ISC does show activity for this port if you search on it, but no details are included. > >FYI, I work at an MSSP with many devices across different public address spaces. I see this traffic at only one range: 12.0.0.0/8. This belongs to AT&T. > >Anyone else seen this at all? Any idea what exploit this uses or what tool might generate it? > > >Thanks in advance, > > >Mike > > >_______________________________________________ >Intrusions mailing list >[email protected] >http://www.dshield.org/mailman/listinfo/intrusions > > _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions