TCP Port 15118

Common Use

Not commonly used port.

Inbound Traffic

Typically unsolicited inbound traffic to this port are Dipnet/Oddbob scans which is a worm that was designed to infect and control systems for use within BotNets via IRC issued commands.  Dipnet/Oddbob infects systems via an old exploit on TCP Port 445 made famous by the Sasser Worm which was released in May 2004 in which in itself is rather disappointing as it indicates that these infected systems are poorly maintained as there has been a patch available via Windows Update for this exploit for well over a year (Microsoft Security Bulletin MS04-011).  Dipnet/Oddbob also scans TCP port 11768.

Outbound Traffic

Outbound scans especially if occurring in volume should be considered an indication of a possible infection or compromise on the source computer and should be investigated immediately.

Additional Information

PortPeeker Capture of 11768 / 15118 Dipnet/Oddbob scan

An excellent technical write up on Dipnet/Oddbob worm from LURHQ

Attacks on 11768 as discussed on DSLReports

Page last updated on February 09, 2005