Ethereal-users: RE: [Ethereal-users] Solved: 78 percent of ARP packets on the network

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Simon Hailstone" <Simon.Hailstone@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 28 May 2004 11:06:07 +0100
> This definitely is not normal and we found some
> weird program listening(??) on port 9876 on every
> machine. Maybe a bug in this worm/trojan/whatever
> caused it to arp without learning the response.

There are two trojans that are known to operate on
tcp/9876, Rux and CyberAttacker/"Portal of Doom".
Neither of them are very nice :-(

Hope you got everything cleaned up OK!


Best Regards,

Simon Hailstone
Orthogon Systems