One of our ISS Server Sensors is reporting UDP Port Scans (UDP_Port_Scan event) from several internal servers (mix of Unix and NT) to 1 target machine (NT). They scan 4 random UDP ports from a range of 1000 to 4999 approximatley every couple of hours, 24/7.
One of the Unix servers was running TNG until it was disabled, yet the events are still being seen. Any ideas or suggested courses of action? Jon. __________________________________________________ Do You Yahoo!? Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com _______________________________________________ ISSForum mailing list [EMAIL PROTECTED]
