[ale] Unusual scans

[jasonday at worldnet.att.net (Jason Day)]

On Thu, Aug 21, 2003 at 05:55:07PM -0400, Dow Hurst wrote:
> ping

No, ping uses ICMP.  These are scans to TCP port 1, which, as Brian
points out, is the tcpmux port.  I did some googling, and it looks like
there was a worm way back in 1998 that affected IRIX, but I haven't seen
anything recent that uses this port.  Is there a new worm on the
horizon?  For IRIX???
-- 
Jason Day                                       jasonday at
http://jasonday.home.att.net                    worldnet dot att dot net
 
"Of course I'm paranoid, everyone is trying to kill me."
    -- Weyoun-6, Star Trek: Deep Space 9
_______________________________________________
Ale mailing list
Ale at ale.org
http://www.ale.org/mailman/listinfo/ale