Internet Storm Center
Training
Certification
Cyber Security Graduate School
Security Awareness Training
Computer Forensics
Penetration Testing
IT Audit
Software Security
The "Trend" is an attempt to put a number to the increase in activity for a given port.
Right now, I am comparing the last 24 hours to the last 30 days.
So if we see a rise in activity compared to the last 30 days, the trend is high.
The following formula is used to calculate the trend:
sqrt( (S-s)^2/s + (T-t)^2/t ) )
S: number of source IPs hitting this port last 24 hrs.
s: average number of source IPs hitting this port each day (last 30 days).
T/t: same for target IPs detecting scans on this port.
| Port | Trend | Service |
|---|---|---|
| 695 | 2 | ieee-mms-ssl |
| 681 | 2 | entrust-aams |
| 747 | 2 | fujitsu-dev |
| 495 | 1 | intecourier |
| 463 | 1 | alpes |
| 397 | 1 | mptn |
| 634 | 1 | ginad |
| 474 | 1 | tn-tl-w1, tn-tl-w2 |
| 754 | 1 | krb_prop, tell |
| 731 | 1 | netviewdm3 |
| 435 | 1 | mobilip-mn |
| 584 | 1 | keyserver |
| 764 | 1 | omserv |
| 510 | 1 | fcp, t0rnkit-sshd |
| 352 | 1 | bhoedap4, dtag-ste-sb |
| 567 | 1 | banyan-rpc |
| 350 | 1 | matip-type-a |
| 205 | 1 | at-5 |
| 585 | 1 | imap4-ssl |
| 282 | 1 | cableport-ax |
| 773 | 1 | notify, submit |
| 569 | 1 | ms-rome |
| 149 | 1 | aed-512 |
| 396 | 1 | netware-ip |
| 148 | 1 | cronus, jargon |
| 349 | 1 | mftp |
| 321 | 1 | pip |
| 365 | 1 | dtk |
| 191 | 1 | prospero |
| 154 | 1 | netsc-prod |
| 346 | 1 | zserv |
| 457 | 1 | scohelp |
| 311 | 1 | asip-webadmin |
| 197 | 1 | dls |
| 579 | 1 | decbsrv |
| 799 | 1 | controlit |
| 263 | 1 | hdap |
| 187 | 1 | aci |
| 166 | 1 | NokNok, s-net |
| 357 | 1 | bhevent |
| 525 | 1 | timed |
| 551 | 1 | cybercash |
| 619 | 1 | digital-evm |
| 518 | 1 | ntalk |
| 371 | 1 | clearcase |
| 204 | 1 | at-echo |
| 126 | 1 | nxedit, unitary |
| 260 | 1 | openport |
| 129 | 1 | pwdgen |
| 377 | 1 | tnETOS |
| 556 | 1 | remotefs |
| 776 | 1 | wpages |
| 136 | 1 | profile |
| 127 | 1 | locus-con |
| 29 | 1 | altavista-fw97, msg-icp |
| 12753 | 1 | tsaf |
| 374 | 1 | legent-2 |
| 466 | 1 | digital-vrc |
| 108 | 1 | snagas |
| 786 | 1 | concert |
| 46 | 1 | mpm-snd |
| 38 | 1 | rap |
| 117 | 1 | uucp-path |
| 12002 | 1 | entexthigh |
| 54 | 1 | xns-ch |
| 447 | 1 | ddm-dfm |
| 72 | 1 | netrjs-2 |
| 1015 | 1 | DolyTrojan |
| 94 | 1 | objcall |
| 688 | 1 | realm-rusd |
| 257 | 1 | fw1, set |
| 12468 | 1 | webtheater |
| 763 | 1 | cycleserv |
| 206 | 1 | at-zis |
| 92 | 1 | npp |
| 459 | 1 | ampr-rcmd |
| 71 | 1 | netrjs-1 |
| 10204 | 1 | ca-licensem |
| 426 | 1 | smartsdp |
| 120 | 1 | cfdptkt |
| 62 | 1 | acas |
| 44 | 1 | Arctic, mpm-flags |
| 1008 | 1 | Lion, ufsd |
| 51140 | 1 | freedom |
| 6002 | 1 | x11 |
| 641 | 1 | repcmd |
| 13014 | 1 | PsychWard |
| 145 | 1 | uaac |
| 18 | 1 | msp |
| 134 | 1 | ingres-net |
| 873 | 1 | rsync |
| 462 | 1 | datasurfsrvsec |
| 11720 | 1 | h323callsigalt |
| 37849 | 1 | officescan |
| 467 | 1 | mylex-mapd |
| 317 | 1 | zannet |
| 501 | 1 | stmf |
| 364 | 1 | aurora-cmgr |
| 91 | 1 | mit-dov |
| 11223 | 1 | Progenictrojan, SecretAgent |
