 starreemPremium
join:2000-12-22
Raleigh, NC
 ·Earthlink Cable ..
 ·EarthLink
| reply to Link Logger
Re: attacks on port 11768? Link Logger- I had posted a similar query earlier in the day.
»Excessive traffic on port 11768
I still have the logs if your are interested.
--
From the Depths of Lurk |
|
|
|
kpatzMY HEAD A SPLODEPremium
join:2003-06-13
Manchester, NH
1 edit | I haven't seen anything on 11768, yet. You say you're seeing these hits from private (unrouteable) IP addresses? What IPs? Can you see the TTL value in the packets? I bet they're coming from a misconfigured box on the same subnet as you. Or someone's spoofing the source IP in the scans (possible for UDP or ICMP but not likely for TCP since a handshake can't normally occur).
Also, are they TCP or UDP scans?
--
SMTP: Spam and Malware Transfer Protocol. Also used on rare occasion to transmit e-mail messages. |
|
jamesvPremium
join:2003-03-08
Austin, TX | said by kpatz:I haven't seen anything on 11768, yet. You say you're seeing these hits from private (unrouteable) IP addresses? What IPs? Can you see the TTL value in the packets? I bet they're coming from a misconfigured box on the same subnet as you. Or someone's spoofing the source IP in the scans (possible for UDP or ICMP but not likely for TCP since a handshake can't normally occur). Also, are they TCP or UDP scans? The unroutable source addresses were things like 192.168.30.126. There are lots from a variety of unrelated routable IPs.
It's a TCP port. 808 probes since Jan 2 evening on MCI but only 8 since Dec 28 on Road Runner and none from SBC/Yahoo!
None logged on a couple of routers I monitor on Verizon and Sprint. |
|
