Cheung, Rick wrote:
Hi. Anyone notice an increase of TCP Syns to port 11768, and 445 across random internet IPs? I googled the port, and found a similar posting here:
http://www.trustedmatrix.org/portal/forum_viewtopic.php?7.954
We located the source on our network, updated DATs, and WindowsUpdate hotfixes, but the problem persists.
445 is always active. Whether the million worms who scan for it, kiddies, etc., you'll always see a ton of connections.
We have seen an increase this past month in tcp/445 activity though. No idea about 11768, but Google seems to be full with it.
Gadi.
