Firewall Wizards mailing list archives

Interesting Packets


From: john_smith () rd qms com
Date: Mon, 26 Jan 98 11:42:20 -0600


     Hi All,
     
          We have been denying a lot of UDP packets to port 27500 recently 
     literally from all over the world.  By a lot I mean over 400 packets 
     from over 350 unique source addresses.  (I'm assuming the source 
     addresses are being spoofed).  The packets are only destined to 
     approximately six of our IP addresses.  All of the destination 
     addresses are in subnets we aren't using (we 'own' our address space).
     
     #1) I haven't been able to find anything about UDP port 27500.  Does 
     anyone know of any 'well-known' applications running on this port?
     
     #2) Are the feelings of the list that this is an attack, information 
     gathering, etc.?
     
     #3) Should this be reported to CERT?
     
          Thanks in advance.
     
     John C. Smith
     Sys Admin/Jack-of-all-trades:)
     QMS, Inc.
     1 Magnum Pass
     Mobile, AL  36618




Current thread: