[nsp-sec] TCP-23 Increase

[Daniel, Sandie M CTR JTF-GNO J3]

Let me clarify that.

I'm _not_ seeing a spike in port 23 traffic.

It only appears that way because there is a bug in my (.mil) sensor/silk
solution. The cookie-cutter template gets applied even though the protocol
doesn't have a 'port', the template just grabs whatever value is at that
position. In this case '23'. 


Sandie Daniel (Confluent Logic)
Joint Task Force Global Network Operations
J34 Analytical Support and Coordination Branch
Tier 3 Analysis Support Team
Comm: 703-601-6530 DSN: 329-6530

-----Original Message-----
From: nsp-security-bounces at puck.nether.net
[mailto:nsp-security-bounces at puck.nether.net] On Behalf Of Daniel, Sandie M
CTR JTF-GNO J3
Sent: Monday, June 30, 2008 4:16 PM
To: 'Matthew.Swaar at us-cert.gov'; nsp-security at puck.nether.net
Subject: Re: [nsp-sec] TCP-23 Increase

----------- nsp-security Confidential --------

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4952 bytes
Desc: not available
URL: <https://puck.nether.net/mailman/private/nsp-security/attachments/20080630/5608ac73/attachment-0001.bin>