|reply to kpatz |
Re: Blackice "Witty" Worm: source port 4000 UDP
said by kpatz:
I'm guessing the "random" destination port is calculated based on the destination IP. I'm making this assumption based on the fact that every single Witty hit I've seen on my IP has had the same destination port, 18067. Not exactly "random"...
There's a Bugtraq post with an attempted disassembly, but the author doesn't seem totally confident in the intrepretation. Still, you might be interested:
Feedback? e-mail: email@example.com