SV: [Snort-users] BAD TRAFFIC data in TCP SYN packet

Lars Jørgensen IT Lars.Jorgensen at ...4490...
Mon Jan 14 13:15:04 EST 2002


>Got similar and they resolved to something.windowsupdate.com. I am
wondering 
>if this has anything to do with windows XP and it's auto-update features.

It goes to my DNS server on port 53, and that server is a windows 2000 box.
I doubt microsoft's update-protocol would use DNS-port for updates.


Lars




More information about the Snort-users mailing list