full-disclosure - Increase probe on UDP port 1026

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <7CFCCE15FC109143AA78DF2FFF60CC7D171A31@EXCHANGEA.mgmt.ad.uconn.edu>
From: phil.rodrigues at uconn.edu (Rodrigues, Philip)
Subject: Increase probe on UDP port 1026

I'm sitting in front of two Class B's.  We saw a steady increase in the unique external IPs scanning us for UDP 1026, 1030 today since 0700 EST.  This chart shows the number of unique external IPs with incoming UDP 1026 traffic per hour since noon.  First column is hour in EST:

00  209
01   93  
02   92   
03  112   
04   33    
05   34   
06   92    
07  211   
08  282   
09  409   
10  494   
11  598   
12  709
13  871    
14 1039    
15 1263    
16 1392    
17 1559    
18 1722   
19 1905

UDP 1030 also appears to be increasing at the same rate.  I took samples at 12:00, 14:00, 16:00, and 18:00 and got results of 833, 1205, 1448, and 1784.

We had two hosts pop up today and start scanning for this - I will try to get my hands on them tomorrow.

Phil

=======================================
Philip A. Rodrigues
Network Analyst, UITS
University of Connecticut

email: phil.rodrigues@...nn.edu
phone: 860.486.3743
fax: 860.486.6580
web: http://www.security.uconn.edu <http://www.security.uconn.edu> 
=======================================

	-----Original Message----- 
	From: full-disclosure-admin@...ts.netsys.com on behalf of Irwan Hadi 
	Sent: Mon 12/1/2003 6:40 PM 
	To: full-disclosure@...ts.netsys.com 
	Cc: 
	Subject: [Full-Disclosure] Increase probe on UDP port 1026