If they are all pointed at the external IP for your firewall then it may be latent packets from someone inside playing Quake 3. If there are multiple IPs involved then probably just a sweep looking for a server. Anyone know of any exploits against a machine running a Quake 3 server (that aren't just targeted at being a 'leet dood quake player?)
-----Original Message----- From: MWiener [mailto:[EMAIL PROTECTED]] Sent: Monday, April 22, 2002 11:55 AM To: Frank Zastawnik; [EMAIL PROTECTED] Subject: RE: [gb-users] Port 27960 Frank, Thanks for the quick reply. I guess they are just mapping out Quake 3 servers. Mike. At 10:37 AM 4/22/02 -0400, Frank Zastawnik wrote: >I believe that port is associated with Quake 3. > > >-----Original Message----- >From: MWiener [mailto:[EMAIL PROTECTED]] >Sent: Monday, April 22, 2002 11:38 AM >To: [EMAIL PROTECTED] >Subject: [gb-users] Port 27960 > > >All, > >I have been hit repeatedly by port scans for UDP 27960. Usually >searching for that port on my machine. Two or three pokes at a time by >more than a dozen source IP addresses over the last 48 hours. >Sometimes it is both the source and destination ports which is why I think it may be a virus. > >Has anyone else seen this? The other possibility is that I am the only >one seeing this and that someone is trying to use a likely port that >the gnat box would use to see if they can poke through the firewall. >If it is the latter, I would really like to know if I have been >targeted. > >Thanks for your help, > >Mike. > >[EMAIL PROTECTED] > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: [EMAIL PROTECTED] >To subscribe to the digest version first unsubscribe, then > e-mail: [EMAIL PROTECTED] >For additional commands, e-mail: [EMAIL PROTECTED] >Archive of the last 1000 messages: >http://www.mail-archive.com/[email protected] > >--------------------------------------------------------------------- >To unsubscribe, e-mail: [EMAIL PROTECTED] >To subscribe to the digest version first unsubscribe, then > e-mail: [EMAIL PROTECTED] >For additional commands, e-mail: [EMAIL PROTECTED] >Archive of the last 1000 messages: >http://www.mail-archive.com/[email protected] > > [EMAIL PROTECTED] --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] To subscribe to the digest version first unsubscribe, then e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] Archive of the last 1000 messages: http://www.mail-archive.com/[email protected]
