[Snort-users] Re: Sockets de Troie/udp 5000

chesney at ...225... chesney at ...225...
Tue Aug 1 12:09:19 EDT 2000


Ed Padin <epadin at ...200...> wrote:

>Hi,
>
>I'm getting a sockets de troi rule trip on snort. Normally, I'd think it was
>a false positive except that the workstation has a source port of 5000 and
>the destination is also 5000 (UDP). Is there another service that uses this
>port?
>
I saw a lot of these for a while, too. I tracked it down, and it turned out
to be a user running a VDO client on his workstation. VDO is video/audio
chatline software.


        --Scott                                 Network/Systems Engineer
        chesney at ...226...                      Golden Valley Electric Assoc.
        (907) 458-5859                            Fairbanks, Alaska   
                   http://home.gci.net/~loco-lobo
===============================================================================

"The best long distance runners eat raw meat, run naked and sleep in the snow"
                                                 -- from an Alaska Airlines ad




More information about the Snort-users mailing list