[Bro] inbound PortScans that aren't really...

Robin Sommer robin at icir.org
Thu Sep 27 09:49:33 PDT 2007

On Wed, Sep 26, 2007 at 16:37 -0500, Randolph Reitz wrote:

> few others, on the Fermilab traffic.  I see a lot of inbound scans  
> that appear to be bogus.  For example...

Can you send me a trace of one of these scans? (Just TCP control
packets is fine if there's content you can't pass on). 


Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org 
LBNL/ICSI    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list