Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: Lots of incoming traffic on UDP 1026 and UDP 1027? |
|---|---|
| Date: | Tue, 28 Dec 2004 11:39:04 -0600 |
I believe it's windows messenger traffic, most likely spam. Search google for udp port 1026 and you'll get a lot of links regarding it. Activity to the windows messenger port seems to have been on the upswing since early December. I know that ICQ (a chat program) used udp port 1027. That could be spam coming in, too. FocusHacks <focushacks@gmail.com> 12/27/2004 12:34 PM Please respond to webmaster@focushacks.com To security-basics@securityfocus.com cc Subject Lots of incoming traffic on UDP 1026 and UDP 1027? I searched the archives at SecurityFocus and couldn't come up with anything useful other than someone with Zone Alarm obviously saw the same activity and people were trying to tell him to look for listening ports on his machine, which is not the case. I'm getting literally hammered by tons of various IP's on UDP 1026 and UDP 1027 I've attached a CSV log, modified a bit, from my NetScreen 5. I only showed the last 15 bytes of the Source IP:Port so the first octet, give or take a few bytes, is cut off. I left a few columns out as well. Let me know, this has been going on for quite a while, and all my searches are ending in vain. Any ideas? -- http://www.FocusHacks.com - The Ford Focus Modification Site!
1026-1027.csv
Description: Binary data
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: Lots of incoming traffic on UDP 1026 and UDP 1027?, JGrimshaw |
|---|---|
| Next by Date: | Re: bridge detection, Joe Hood |
| Previous by Thread: | Re: Lots of incoming traffic on UDP 1026 and UDP 1027?, Sebastian |
| Next by Thread: | RE: Lots of incoming traffic on UDP 1026 and UDP 1027?, Paul Duffany |
| Indexes: | [Date] [Thread] [Top] [All Lists] |