[Snort-users] Re: Sockets de Troie/udp 5000

chesney at ...225... chesney at ...225...
Tue Aug 1 12:09:19 EDT 2000

Ed Padin <epadin at ...200...> wrote:

>I'm getting a sockets de troi rule trip on snort. Normally, I'd think it was
>a false positive except that the workstation has a source port of 5000 and
>the destination is also 5000 (UDP). Is there another service that uses this
I saw a lot of these for a while, too. I tracked it down, and it turned out
to be a user running a VDO client on his workstation. VDO is video/audio
chatline software.

        --Scott                                 Network/Systems Engineer
        chesney at ...226...                      Golden Valley Electric Assoc.
        (907) 458-5859                            Fairbanks, Alaska   

"The best long distance runners eat raw meat, run naked and sleep in the snow"
                                                 -- from an Alaska Airlines ad

More information about the Snort-users mailing list