Re: unusual activity on IP based ports?

Very very possible. I can't mention the name of the malware or any more 
details, but I would get some actual tcpdumpped packets and submit them in 
here.

J

On 8/2/05, [email protected] <[email protected]> wrote:
> 
> i have 3 boxes on same subnet on internet. each box is probed a couple
> times per day on a single port from 2 or 3 machines. the interesting thing
> is that the port is different for each of my hosts, but always consistent
> on that host from one day to the next.
> 
> any chance someone has seen some malware that hashes the IP its probing to
> come up with a unique port?
> 
> allan
> 
> _______________________________________________
> Intrusions mailing list
> [email protected]
> http://www.dshield.org/mailman/listinfo/intrusions
>
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions