[853] in resnet
Port 18023 ?
daemon@ATHENA.MIT.EDU (Denise Christenson)
Fri Feb 15 15:31:45 2002
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Message-ID: <sc6d2511.064@gwhub1>
Date: Fri, 15 Feb 2002 15:11:04 -0500
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: Denise Christenson <christen@USNA.EDU>
To: RESNET-L@listserv.nd.edu
We have a node here that we were told participated with 99 other nodes in a DDoS attack against a system at another site.
The system was brought to my office, and as soon as I fired it up I checked and saw that it was connected to ip address 216.74.117.247 and listening on port 18023.
I think it is a bot/zombie on the system that caused this, but the kid has downloaded so many files from mIRC, I have no idea which one holds the bot. I'm just curious and trying to figure this out for future reference.
Anyone have any ideas on where I should start?
Thanks,
Denise
Denise Christenson U. S. Naval Academy
Network Engineer Information Technology Services
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
