[nsp-sec] tcp/23 increase

[Smith, Donald]

Thanks David, I confirmed 31 out of the 34 hosts you showed for as209 were scanning for open telnet services across the net. So your report is verified:)

Additionally while looking at the netflow I saw some unusual patterns in the scanning.
The source port is pretty low. Something like 2k-4k (maybe 5k?) and the SYN packets are 60bytes long.
That implies options. In normal traffic the most common syn I see is 48 bytes long, 52 isn't very unusual, 40 happens but not very often any more except in ddos attacks;)
I don't think I have ever seen a 60byte syn before.




(coffee != sleep) & (!coffee == sleep)
Donald.Smith at qwest.com gcia

> -----Original Message-----
> From: nsp-security-bounces at puck.nether.net
> [mailto:nsp-security-bounces at puck.nether.net] On Behalf Of
> Greenberg, David A
> Sent: Wednesday, January 13, 2010 2:02 PM
> To: NSP-SEC List
> Subject: [nsp-sec] tcp/23 increase
>
> ----------- nsp-security Confidential --------
>
>

This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful.  If you have received this communication
in error, please immediately notify the sender by reply e-mail and destroy
all copies of the communication and any attachments.