What Malicious traffic is your Firewall Protecting you from?

This not an all inclusive list but typically represents about 99% of our daily unsolicited scans blocked by our firewalls as logged by Link Logger and port captures by PortPeeker or are ports we are commonly asked about.  The idea behind this is to give you an idea as to what the malicious traffic is that your firewall is protecting you from.  Of course everyone's environment might differ (for example some ISP filter out all TCP 445 traffic), but typically this is representative of what most internet users will see.  Don't believe us, turn on logging on your firewall and see for yourself......

• TCP Port 21 - FTP connection attempts

• TCP Port 53 - DNS Scan

• TCP Port 42 - WINS Exploit

• UDP Port 67 - Bootps

• UDP Port 68 - Bootpc

• UDP Port 69 - TFTP

• TCP Port 80 - IIS Exploits

• TCP Port 135 - RPC Exploit Attack

• UDP Port 137 - BugBear, Opeserv, et al scans for available open shares

• TCP Port 139 - Open Share connection attempts for file shares on Windows 9x, ME and NT

• TCP Port 445 - Open Share connection attempts for file shares on Win2k, XP, and Win2k3 / Sasser / Korgo worms

• TCP Port 559 - Domwis Trojan and Proxy scans

• TCP Port 1025 - RPC / LSA Exploit Attacks

• UDP Port 1026 - Messenger Spam

• UDP Port 1027 - Messenger Spam

• UDP Port 1028 - Messenger Spam

• UDP Port 1029 - Messenger Spam

• TCP Port 1433 - Connection attempts to SQL Server

• UDP Port 1434 - SQL Slammer worm

• TCP Port 2100 - Oracle XDB FTP scans

• TCP Port 2745 - Beagle/Bagle backdoor scans

• TCP Port 2535 - Beagle/Bagle backdoor scans

• TCP Port 3127 - myDoom backdoor scans

• TCP Port 3306 - mySQL Bot scans

• TCP Port 3410 - OptixPro trojan scans

• TCP Port 5000 - UPNP Buffer Overfull Attack

• TCP Port 5554 - Sasser FTP Server Attack

• TCP Port 6101 - Agent Browser Attack

• TCP Port 6129 - Dameware scans

• TCP Port 10000 - Veritas Backup Exec Remote Attack

• TCP Port 11768 - DipNet/OddBob scans

• TCP Port 15118 - DipNet/OddBob scans

• TCP Port 27374 - Subseven scans

• TCP Port 65506 - Spam Relay scans

• ICMP Pings - Nachi/Welchia/Sasser.D worm

Quick Comparison of Attack and Scan rates for February 2004 and February 2005 (good and bad news)

September 1 - 17, 2004 Inbound Traffic Report, which could be used for a baseline as there were no major events.

May 2004 Traffic Review of one of our Networks showing the effects of Sasser, Bobax, Kurgo worms, etc.

US-CERT Current Activity which includes current worms and email virus activity.

Page last updated on November 26, 2006