[Snort-users] Port 9704

Graeme Fowler graeme.f at ...875...
Wed Nov 29 11:04:13 EST 2000


Kai Moritz wrote:
> I've detected a scan on Port 9704, but I can't find that port in
> /etc/services or on the trojan-lists I know!

9704 commonly has a rootshell bound to it after a successful attempt at
one of the many recent RPC or FTP exploits. I guess someone's just
decided to walk across your netblock searching for previously cracked
machines. Let's hope they didn't find any :)

Graeme





More information about the Snort-users mailing list