Internet Storm Center
Training
Certification
Cyber Security Graduate School
Security Awareness Training
Computer Forensics
Penetration Testing
IT Audit
Software Security
The "Trend" is an attempt to put a number to the increase in activity for a given port.
Right now, I am comparing the last 24 hours to the last 30 days.
So if we see a rise in activity compared to the last 30 days, the trend is high.
The following formula is used to calculate the trend:
sqrt( (S-s)^2/s + (T-t)^2/t ) )
S: number of source IPs hitting this port last 24 hrs.
s: average number of source IPs hitting this port each day (last 30 days).
T/t: same for target IPs detecting scans on this port.
| Port | Trend | Service |
|---|---|---|
| 695 | 2 | ieee-mms-ssl |
| 706 | 2 | silc |
| 681 | 2 | entrust-aams |
| 747 | 2 | fujitsu-dev |
| 495 | 1 | intecourier |
| 463 | 1 | alpes |
| 397 | 1 | mptn |
| 662 | 1 | pftp |
| 634 | 1 | ginad |
| 730 | 1 | netviewdm2 |
| 474 | 1 | tn-tl-w1, tn-tl-w2 |
| 754 | 1 | krb_prop, tell |
| 731 | 1 | netviewdm3 |
| 435 | 1 | mobilip-mn |
| 584 | 1 | keyserver |
| 764 | 1 | omserv |
| 510 | 1 | fcp, t0rnkit-sshd |
| 992 | 1 | telnets |
| 352 | 1 | bhoedap4, dtag-ste-sb |
| 594 | 1 | tpip |
| 567 | 1 | banyan-rpc |
| 503 | 1 | intrinsa |
| 350 | 1 | matip-type-a |
| 205 | 1 | at-5 |
| 356 | 1 | cloanto-net-1 |
| 585 | 1 | imap4-ssl |
| 282 | 1 | cableport-ax |
| 595 | 1 | cab-protocol |
| 773 | 1 | notify, submit |
| 569 | 1 | ms-rome |
| 497 | 1 | dantz |
| 221 | 1 | fln-spx |
| 469 | 1 | rcp |
| 366 | 1 | odmr |
| 149 | 1 | aed-512 |
| 396 | 1 | netware-ip |
| 148 | 1 | cronus, jargon |
| 287 | 1 | k-block |
| 349 | 1 | mftp |
| 201 | 1 | at-rtmp |
| 321 | 1 | pip |
| 365 | 1 | dtk |
| 191 | 1 | prospero |
| 154 | 1 | netsc-prod |
| 346 | 1 | zserv |
| 193 | 1 | srmp |
| 527 | 1 | stx |
| 457 | 1 | scohelp |
| 311 | 1 | asip-webadmin |
| 197 | 1 | dls |
| 579 | 1 | decbsrv |
| 799 | 1 | controlit |
| 263 | 1 | hdap |
| 187 | 1 | aci |
| 166 | 1 | NokNok, s-net |
| 103 | 1 | gppitnp |
| 357 | 1 | bhevent |
| 525 | 1 | timed |
| 551 | 1 | cybercash |
| 619 | 1 | digital-evm |
| 518 | 1 | ntalk |
| 371 | 1 | clearcase |
| 204 | 1 | at-echo |
| 126 | 1 | nxedit, unitary |
| 260 | 1 | openport |
| 129 | 1 | pwdgen |
| 377 | 1 | tnETOS |
| 556 | 1 | remotefs |
| 104 | 1 | acr-nema |
| 776 | 1 | wpages |
| 136 | 1 | profile |
| 208 | 1 | at-8 |
| 127 | 1 | locus-con |
| 532 | 1 | ibm-db2, netnews |
| 29 | 1 | altavista-fw97, msg-icp |
| 12753 | 1 | tsaf |
| 374 | 1 | legent-2 |
| 466 | 1 | digital-vrc |
| 108 | 1 | snagas |
| 786 | 1 | concert |
| 46 | 1 | mpm-snd |
| 30700 | 1 | Mantis |
| 38 | 1 | rap |
| 117 | 1 | uucp-path |
| 12002 | 1 | entexthigh |
| 54 | 1 | xns-ch |
| 447 | 1 | ddm-dfm |
| 72 | 1 | netrjs-2 |
| 1015 | 1 | DolyTrojan |
| 94 | 1 | objcall |
| 688 | 1 | realm-rusd |
| 953 | 1 | rndc |
| 257 | 1 | fw1, set |
| 742 | 1 | netrcs |
| 12468 | 1 | webtheater |
| 763 | 1 | cycleserv |
| 206 | 1 | at-zis |
| 92 | 1 | npp |
| 459 | 1 | ampr-rcmd |
| 71 | 1 | netrjs-1 |
