[Full-Disclosure] Increase probe on UDP port 1026

[Rodrigues, Philip]

I'm sitting in front of two Class B's.  We saw a steady increase in the unique external IPs scanning us for UDP 1026, 1030 today since 0700 EST.  This chart shows the number of unique external IPs with incoming UDP 1026 traffic per hour since noon.  First column is hour in EST:
 
00  209
01   93  
02   92   
03  112   
04   33    
05   34   
06   92    
07  211   
08  282   
09  409   
10  494   
11  598   
12  709
13  871    
14 1039    
15 1263    
16 1392    
17 1559    
18 1722   
19 1905
 
UDP 1030 also appears to be increasing at the same rate.  I took samples at 12:00, 14:00, 16:00, and 18:00 and got results of 833, 1205, 1448, and 1784.
 
We had two hosts pop up today and start scanning for this - I will try to get my hands on them tomorrow.
 
Phil
 
=======================================
Philip A. Rodrigues
Network Analyst, UITS
University of Connecticut

email: phil.rodrigues at uconn.edu
phone: 860.486.3743
fax: 860.486.6580
web: http://www.security.uconn.edu <http://www.security.uconn.edu> 
=======================================


	-----Original Message----- 
	From: full-disclosure-admin at lists.netsys.com on behalf of Irwan Hadi 
	Sent: Mon 12/1/2003 6:40 PM 
	To: full-disclosure at lists.netsys.com 
	Cc: 
	Subject: [Full-Disclosure] Increase probe on UDP port 1026