From owner-freebsd-security Wed Aug 8 13:56:48 2001 Delivered-To: freebsd-security@freebsd.org Received: from mail.system (pec-124-116.tnt8.m2.uunet.de [149.225.124.116]) by hub.freebsd.org (Postfix) with SMTP id B1F0137B40B for ; Wed, 8 Aug 2001 13:56:41 -0700 (PDT) (envelope-from mailings@analogon.com) Received: (qmail 23818 invoked by uid 1013); 8 Aug 2001 20:56:33 -0000 Received: from laptop.system (HELO laptop) (192.168.1.9) by daemon.system with SMTP; 8 Aug 2001 20:56:33 -0000 Message-ID: <002701c1204c$7386c520$0901a8c0@system> From: "Tom Beer" To: "Conrad Sabatier" , "Andre Goeree" Cc: References: Subject: Re: multiple port scans: tcp/8888 Date: Wed, 8 Aug 2001 22:55:26 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2615.200 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Hi, the matter that the scans come from different addresses says, in first instant nothing. It could be a decoy'ed attack, where only one address is the "real" origin Greets TOm > > On 05-Aug-2001 Andre Goeree wrote: > > Hello -security, > > > > Attached is part of my ipfilter log. The file shows port scans coming > > in from 25 different IP addresses from all over the world (Europe, > > USA, Asia) to tcp/8888. Since I could not find any information about > > tcp/8888, any comments are appreciated. > > > > Ago. > > Port 8888 is used by the OpenNap (Napster clone) server. I'd say this is most > likely what people are looking for. > > -- > Conrad Sabatier > conrads@home.com > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message