TCP Syns to 445 and 11768

Mailman List Mirror (Read Only)
1

Hi. Anyone notice an increase of TCP Syns to port 11768, and 445 across random internet IPs? I googled the port, and found a similar posting here:

http://www.trustedmatrix.org/portal/forum_viewtopic.php?7.954

We located the source on our network, updated DATs, and WindowsUpdate hotfixes, but the problem persists.

2

Cheung, Rick wrote:

  Hi. Anyone notice an increase of TCP Syns to port 11768, and 445
across random internet IPs? I googled the port, and found a similar posting
here:

http://www.trustedmatrix.org/portal/forum_viewtopic.php?7.954

  We located the source on our network, updated DATs, and
WindowsUpdate hotfixes, but the problem persists.

445 is always active. Whether the million worms who scan for it, kiddies, etc., you'll always see a ton of connections.

We have seen an increase this past month in tcp/445 activity though. No idea about 11768, but Google seems to be full with it.

  Gadi.

3

If we're not allowed to "take an action based on this message" by replying
to it, what's the point of posting it to the list?

Jeff

4

Cheung, Rick wrote:

        Hi. Anyone notice an increase of TCP Syns to port 11768, and 445 across random internet IPs? I googled the port, and found a similar posting here:

http://www.trustedmatrix.org/portal/forum_viewtopic.php?7.954

        We located the source on our network, updated DATs, and WindowsUpdate hotfixes, but the problem persists.

Okay, it's been a while since this post was made to NANOG, but I just got the answer. Hadas Shany (Internet Gold/AS5486] just sent this to the IL-ops list: