TCP Syns to 445 and 11768

Fri Jan 7 16:41:05 UTC 2005

Cheung, Rick wrote:
> 	Hi. Anyone notice an increase of TCP Syns to port 11768, and 445
> across random internet IPs? I googled the port, and found a similar posting
> here:
> 
> http://www.trustedmatrix.org/portal/forum_viewtopic.php?7.954
> 
> 	We located the source on our network, updated DATs, and
> WindowsUpdate hotfixes, but the problem persists.

445 is always active. Whether the million worms who scan for it, 
kiddies, etc., you'll always see a ton of connections.

We have seen an increase this past month in tcp/445 activity though. No 
idea about 11768, but Google seems to be full with it.

	Gadi.