On 7 Nov 99, at 14:34, Jon Griffin wrote:
> I recently got a wave of scans from 5.0.0.4 on ports 65535,4438,3937,3952,
>
> I couldn't find these ports listed in the usual places. Anyone have any
> ideas on who this might be and why those specific ports.
Although some OSes will hand out 65535 occasionally as an outgoing
port, I set my monitor to log anything from port 65535 or port 0;
these sometimes appear as origin ports when the sender doesn't
expect/care about a response, such as when doing a SYN flood.
David G
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
