Re: Part 2 IDS: Scanning on tcp port 27374

[DPG <dgailey@insync.net>]

Archive: http://msgs.securepoint.com/ids
FAQ: http://www.ticm.com/kb/faq/idsfaq.html
IDS: http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
HELP: Having problems... email questions to ids-owner@uow.edu.au
NOTE: Remove this section from reply msgs otherwise the msg will bounce.
SPAM: DO NOT send unsolicted mail to this list.
UNSUBSCRIBE: email "unsubscribe ids" to majordomo@uow.edu.au
-----------------------------------------------------------------------------
Also, set-up tcpdump to listen for any traffic specified for those ports
see if it sent any data within the packet, and what flag bits where set
etc..
[tcpdump -x 'port 27374']
You should also run pktsuck or something to that extent to catch any
data that the person in question might attempt to send once he realizes
that this port is open and accepting connections.
pktsuck is relativley easy to set-up and configure, and provides logging
of data via the syslog facilities.

-dpg


.                                                 .
                        . 

             
                                       
        
                             

   
                                .