D&C GLug - Home Page

[ Date Index ] [ Thread Index ] [ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] UDP Port 37 traffic 2010-02-08

 

On Tue, 9 Feb 2010, Simon Waters wrote:

Gordon Henderson wrote:

Port 37 - Thats "timeserver"... used to send the time & date to a remote site - I think it's generally been disabled for years now... Odd that people are poking data to it!!!

We are seeing it logged because of UDP checksum errors. I'm thinking it could be corrupted DNS traffic, or DDoS/malware related, or port scanning with spoofed packets either way it makes me just a little nervous.

Seems to have stopped around 13:24:22 for the moment.

Still nothing going via my main access routers... There's 14 servers and a few other random boxes behind them, so it's usually quite busy...

Gordon

--
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/linux_adm/list-faq.html