lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1080320081.3106.9.camel@localhost>
From: nicola at delvacchio.it (Nicola Del Vacchio)
Subject: strange traffic ?

Il ven, 2004-03-26 alle 16:32, Aditya, ALD [Aditya Lalit Deshmukh] ha
scritto:
> Dear list,
> i am seeing strange traffic ... first something connects to 139 on
> windows workstation ... 2 packets causes the svchost to crash.
> and then i start seeing traffic to port 4444 from the same ip.
>  

from what source the 139 (UDP or TCP) traffic is coming (internal lan?
dmz? RAS? firewall?????)

what is the direction of the traffic on port 4444 (TCP or UDP?) fom
attacker to workstation or workstation to attacker?

> what is this traffic i am seeing ? any new kind of malware trying to
> open of port 4444 with the initial vector of infection on port 139 ?
>  
>  
> the machine is fully patched and protected by firewall from outside
> world with a sniffer logging all the data ie scr, dst ip and ports
> numbers ( this is how i know the above info ) 
>  
a machine is fully patched only with released patches ;-)



> and nothing suspecipous is there on the machine also ... since the
> machine is under heavy watch anything unsual would be caught
> immediatly.... 
>  
>  
yes, a trace will be apreciated...


ciao
nicola


> -aditya
> 
> Delivered using the Free Personal Edition of Mailtraq
> (www.mailtraq.com)


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ