Still investigating TCP Port 8181 Activity

While we are still looking for more captures of TCP port 8181, "Frealek" suggested today that we are looking at a "personal scanner of some strange software". Another idea submitted by Frealek is a "way to find last hop that routes packets". This technique is most commonly referred to when discussing a mapping tool called "Firewalk"



http://www.packetfactory.net/projects/firewalk/



Firewalk works using *incrementing* TTL's versus the decrementing we are seeing. So the puzzle continues; anybody that has thoughts, comments, questions, or suggestions is welcome to submit anytime.




Tony Carothers

Handler on Duty