That looks like it may have been it. We use IRE SafeNet's SoftPK IPSec client. We uninstalled it from the culprit machine and no longer saw the UDP packets.
Any idea what those packets were about? AH --- [EMAIL PROTECTED] wrote: > > Sonicwall IRE VPN Client perhaps? Look for > IREike.exe in the Task Manager's > process list. > > Joe > > > Adrian Horton > > > <[EMAIL PROTECTED] To: > [EMAIL PROTECTED] > > om> cc: > > > > Subject: Port Scan(?) > > 03/20/2002 01:41 > > > PM > > > The [EMAIL PROTECTED] owner rejected this > post so can anyone here make sense of this? > > On my 10.1.2.0/24 network, I discovered (with > Ethereal) that one of my hosts (10.1.2.112) was > broadcasting UDP packets to 255.255.255.255 to port > 62516. > The *source port* though was incrementing by one > after > every packet. That host machine is running Windows > 2000. > > Anyone know what kind of activity this is? It seems > the opposite of a port scan and it is inside my > private network. I know which machine it is, I just > can't figure out what it was doing so I disconnected > it from the network until I figure it out. > > Thanks, > > AH > __________________________________________________ Do You Yahoo!? Yahoo! Movies - coverage of the 74th Academy Awards® http://movies.yahoo.com/
