[Snort-users] Anyone notice a dramatic increase in port 515 probes?

shawn . moyer shawn at ...1184...
Sat Apr 7 06:02:27 EDT 2001


"Mark W. Davis" wrote:
 
> I seem to be getting a very high rate of sunrpc and printer (port 515)
> probes. Just want to know if anyone else has noticed this trend.

Yup. Seem to be all RPC for awhile (most likely li0n), and now it's lpd
and RPC, prolly the Adore worm -- see CERT and the list archives from a
few days back.



--shawn

-- 

s h a w n   m o y e r
shawn at ...1184...

"Nuclear war would really set back cable."
                             -- Ted Turner




More information about the Snort-users mailing list