[nsp-sec] Anyone else seeing a HUGE increase in TCP/1935 from Limelight Networks

[Dave Burke]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We saw a 10x increase in tcp/1935 this morning and seeing it drop back
to normal levels now. Traffic to/from the limelight /18 was @ normal
levels during that time.

dave

Sean Donelan wrote:
> ----------- nsp-security Confidential --------
> 
> On Mon, 16 Jun 2008, John Fraizer wrote:
>> We've suddenly (since about 1600 GMT today) seen a huge increase in inbound traffic - a very unnatural curve on our graphs.  I have tracked this via flows to a large influx
>> of traffic from Limelight networks.
> 
> The PGA final round is this afternoon.  Could this be a streaming event?
> 
> TCP/1935 Adobe Macromedia Flash Real Time Messaging Protocol (RTMP)
>     "plain" protocol
> 
> Are you seeing it decrease now.  Tiger won.
> 
> 
> 
> 
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
> 
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security counter-measures.
> _______________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIVtS96xddYR6j4jARAvv/AJ448C8lFTAMkv+/t86CF3qM9LtLHACcCl+c
rbS1Mne5ZFkECE4rPROk93o=
=aGDF
-----END PGP SIGNATURE-----