What ports are the popular ones for this attack we are under? Buck -----Original Message----- From: psyche-list-admin@redhat.com [mailto:psyche-list-admin@redhat.com] On Behalf Of Norman E. Brake, Jr. Sent: Sunday, January 26, 2003 9:31 PM To: psyche-list@redhat.com Subject: RE: port 1 & 137 I think 137 is the Microsoft network share browser. Needless to say, those packets are going to be flying all over the place. Norm On Sun, 2003-01-26 at 19:12, Buck wrote: > I was wondering what they might be. I think 137 could be the microsoft > messenger popup ads looking for victims, but I don't know what port 1 > does. > > Buck > > > -----Original Message----- > From: psyche-list-admin@redhat.com [mailto:psyche-list-admin@redhat.com] > On Behalf Of Dave Sherman > Sent: Sunday, January 26, 2003 8:02 PM > To: RedHat 8.0 > Subject: Re: port 1 & 137 > > On Sun, 2003-01-26 at 18:32, Buck wrote: > > My firewall is being hit by a number of different IP addresses (with > one > > exception). > > > > Those looking for port 1 are from source port 761 and those destined > for > > port 137 are from source ports 1036 -1039 > > > > The one exception to the list of ips is 216.237.207.101 who has hit > port > > 1 from port 761. I think this one might be a cracker or script kiddy. > > > Are you just making idle conversation, or is there a question embedded > somewhere in there? > > Dave > > > > > -- > Psyche-list mailing list > Psyche-list@redhat.com > https://listman.redhat.com/mailman/listinfo/psyche-list -- Psyche-list mailing list Psyche-list@redhat.com https://listman.redhat.com/mailman/listinfo/psyche-list -- Psyche-list mailing list Psyche-list@redhat.com https://listman.redhat.com/mailman/listinfo/psyche-list
