RE: High port UDP probe?

[Joakim von Braun]

>> On Tue, 25 Apr 2000, Damian Gerow wrote:
>>
>> > Apr 24 08:48:01 <hostname> kernel: Packet log: unserved DENY eth0
>> > PROTO=UDP 149.225.113.35:31790 xxx.xxx.xxx.xxx:31789 L=29:9 S=0x00
>> > I=64598 T=115
>>
>> Apr 24 03:09:29 <x> kernel: IP fw-in deny eth0:109 UDP
>> 194.133.34.166:10654 <y>:31789 L=29
>> S=0x00 I=24583 F=0x0000 T=114
>>
>> Getting them here, too. Differing sources.
>>
>> Is it known which service/trojan they are looking for, yet?
>
>I don't know. I checked for trojans, and for known port numbers, and
>came up with nothing.

Hi,

It might be the Hack�a�Tack trojan. The information about the ports 31785, 31788, 31789, 31790, 31791, 31792 has been somewhat unreliable sometimes.

Cheers,
Joakim

Joakim von Braun phone +46-(0)8-428 95 05
von Braun Consultants cell phone +46-(0)709-56 16 42
Kristinehovsgatan 14
SE-117 29 Stockholm, SWEDEN
- [To unsubscribe, send mail to [EMAIL PROTECTED] with "unsubscribe firewalls" in the body of the message.]