Dear wilder_jeff Wilder, UDP/111 (Sun RPC) is not used in Windows environment. Either you use some services for Unix, i.e. MS services for Unix, 3rd party NFS/NIS/etc support or this is result of privileged user/trojan/backdoor activity.
--Thursday, December 22, 2005, 8:16:48 PM, you wrote to [email protected]: wW> I have a Windows 2000 terminal server that is consistantly sending wW> out broadcasts to 255.255.255.255:111... below is a capture from a wW> RPC portmap proxy attempt UDP 10.74.32.31:3300/udp wW> 255.255.255.255:111/udp 07:50:35 RPC portmap proxy attempt UDP wW> 10.74.32.31:3291/udp 255.255.255.255:111/udp 07:50:05 -- ~/ZARAZA http://www.security.nnov.ru/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
