I pulled this data from a Proxy Server 2.0 Packet Filter log. What has me
concerned is the seemingly random source and destination ports and in a few
instances the source ports are low ports or, in one case, zero. I wouldn't
think that streaming media would not hop ports like this.

This happened multiple times for 30 seconds to a minute. The source IP was
different each time, but it could have been spoofed.

I have copied a segment of the log below. Note the Source Port = 0, seven
lines from the bottom.

I would appreciate any feedback on this.
Thanks
Josh

Date             Time            Src IP   Dest IP       Proto   SP    DP        Flags  
  Frag     Log Host
----------------------------------------------------------------------------
-----------------------
11/15/2001       10:54:45        a.b.c.188        w.x.y.34       Udp    11769   19892  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:45        a.b.c.188        w.x.y.34       Udp    13100   36866  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    60772   18235  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    2244    10919  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    38860   20639  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    44102   57112  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    36568   22795  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    829     35894  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    13590   37647  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    33653   11083  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    7771    18936  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    14726   58812  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    4688    54193  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    1991    21011  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    16453   45020  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    42955   9480   
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    16725   11659  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    21637   51352  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    52265   54278  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    59684   10008  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    36361   12922  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    59164   41025  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    14928   35887  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    43540   56226  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    5571    40001  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    5808    37741  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    43092   4110   
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    58173   65144  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    22068   51210  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    49295   49263  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    22098   42784  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    12549   47168  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    12920   632    
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    29764   59286  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    62195   57409  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    11021   47211  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    19098   10409  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    51877   37582  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    63826   14992  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:46        a.b.c.188        w.x.y.34       Udp    4       38943  
  -       Frag
 w.x.y.34        -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    28770   54432  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    24934   42285  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    28911   49629  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    34631   14104  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    21288   1666   
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    11473   14786  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    5007    10291  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    42505   5141   
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    5565    59076  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    167     9472   
  -       Frag
 w.x.y.34        -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    14902   36368  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    54022   30931  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    34319   17895  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    59591   13377  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    46095   45974  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    17486   14882  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    57051   40017  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    50639   35439  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    62742   36349  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    39872   2108   
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    45117   11241  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    0       62758  
  -       Frag
 w.x.y.34        -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    49560   17812  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    16902   36153  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    46173   47707  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    57613   21302  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    55572   44996  
  -       Frag
w.x.y.34         -       -
11/15/2001       10:54:47        a.b.c.188        w.x.y.34       Udp    35904   41124  
  -       Frag
w.x.y.34         -       -

Reply via email to