On Mon, 11 Aug 2003 13:14:16 PDT, Joey <[EMAIL PROTECTED]> said: > The targets total has stayed about the same for the > past 2 weeks. I see no difference. > > http://isc.sans.org/port_details.html?port=135
It took me a while to figure that out, until I realized what was going on: Port 135 probes are *SO* prevalent that *every single* submission to DShield has at least one or two dozen (I know my laptop gets several an hour). So what that's *REALLY* measuring is "How many DShield sites have made any sort of report that day" - the "number of targets" is approximately "number of sensors active today". Take a look at the "sources" line instead....
pgp00000.pgp
Description: PGP signature
