[Bro] inbound PortScans that aren't really...
Robin Sommer
robin at icir.org
Thu Sep 27 09:49:33 PDT 2007
On Wed, Sep 26, 2007 at 16:37 -0500, Randolph Reitz wrote:
> few others, on the Fermilab traffic. I see a lot of inbound scans
> that appear to be bogus. For example...
Can you send me a trace of one of these scans? (Just TCP control
packets is fine if there's content you can't pass on).
Robin
--
Robin Sommer * Phone +1 (510) 931-5555 * robin at icir.org
LBNL/ICSI * Fax +1 (510) 666-2956 * www.icir.org
More information about the Bro
mailing list