dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
2
share rss forum feed

psloss
Premium
join:2002-02-24
Lebanon, KS
reply to kpatz

Re: Blackice "Witty" Worm: source port 4000 UDP

said by kpatz:
I'm guessing the "random" destination port is calculated based on the destination IP. I'm making this assumption based on the fact that every single Witty hit I've seen on my IP has had the same destination port, 18067. Not exactly "random"...
There's a Bugtraq post with an attempted disassembly, but the author doesn't seem totally confident in the intrepretation. Still, you might be interested:
»www.securityfocus.com/archive/1/···-03-24/0

Philip Sloss
--
Feedback? e-mail: stuff@lupwa.org