Re: Re: up-to-date list of most common ports

[email protected] said:
> I've seen your email but for some reason didn't reply at that time, 

Same here, but for another reason. I intent to publish a portlist one 
of these days, but that will take some time. I now get around the ACL 
problem by using a distributed scanner. but that means that my logs are 
now scattered across a few locations and I will have to do some hacking 
to merge them. I did not want to make an announcement until I had it
working, but now that the subject has been brought up: expect to hear
something from me some time next week.

 
> Because noone wants to perform full portscans of all suspect hosts,
> and because most proxies nowadays uses really random ports.

I don't the resources to scan *all* suspect hosts, but a few thousand 
per day is enough to pick new trends. Here is my current shortlist:

s4:10099 (ACL!) s5:8012 s4:559 s4:1080 ho:6588 hc:63000 s4:32167 
s4:10777 (ACL!) s5:1098 s5:8015 s4:40053 s5:8020

Most of these are familiar, but there are a few newcomers.

 
> but I too don't pefrorm full protscans (and never did, because we're
> paying per traffic)

I found a pot of gold at the end of the bandwidth rainbow.

----------------------------------------------
This message was sent to the opt-in DSBL list.
If you do not want to receive DSBL messages,
please send mail to [email protected].