[Snort-users] [**] MISC source port 53 to <1023 [**]

Ryan Russell ryan at ...35...
Thu Mar 15 13:08:02 EST 2001


On Wed, 14 Mar 2001, Phil Wood wrote:

> Around 32% of all alerts for today fall in to the port 53 to 137.  I know for
> a fact that the destination hosts (in our address space) are not sending packets
> from 137 to 53.

That's most likely NT DNS servers falling back to NetBIOS trying to look
up names.

					Ryan





More information about the Snort-users mailing list