High volumes of traffic from an internal source may indicate a worm, network monitoring activity, or internal scanning.

----Original Message----
From: David Ward dward@curriki.org
Sent: Monday, April 20, 2009 7:57 AM
To: John Wu; Joshua Marks
Subject: Prod web should not be doing this.

John,

This still seems somewhat odd to be coming from prod-web.

Traffic to ports 53, 25, and possibly 113 seem normal, but initiated
traffic to the other ports does not.

Dave
–

---------- Forwarded message ----------
From: <managed.security@ems.att.com>
Date: Sat, Apr 18, 2009 at 7:32 PM
Subject: AT&T Firewall Multiport Scanning Activity Threat-Case:
3096224863891673 - Host: 63.241.108.236
To: dward@curriki.org, jwu@curriki.org, jmarks@curriki.org,
jocelyn.cuasay@ap.att.com
Cc: managed.security@ems.att.com

Dear Customer:

The AT&T Managed Firewall has detected the following activity at your site.
Please note this is an auto-generated notification from our correlation
engine.

Source: 63.241.108.236
Total connections: 1128
Firewall: MNFCKI01F
Timeframe: 1 hour
Number of distinct targets: 96
Target(s): 24.6.152.42-216.239.38.10

For external sources, this type of activity often indicates automated
scanning.
In that case we recommend a review of the unique ports listed below for
unauthorized activity. High volumes of traffic from an internal
source may indicate
a worm, network monitoring activity, or internal scanning. Proxy servers
can
also generate a large volume of traffic from a single source and are a
common
source of false positives.

If this is normal or expected traffic, please login to BusinessDirect
to create a
MACD and we will filter future alerts from a specified source and
firewall. Replying
to this alert email will not be monitored for or responded to in a
timely manner.
We appreciate your cooperation in this procedure.

Detailed Report:
The MNFCKI01F firewall has observed the 63.241.108.236 IP address making
1128 connections against 96 unique IP addresses within the last hour.
During this interval, there were 5557 events logged by the firewall, of
which
this event made up 20% of that traffic. Of the 114 unique ports/services
seen in use by the firewall during this interval, this source
attempted to contact 42,
or 36% of them.

The unique ports/services observed for this event were:
udp-53 tcp-11284 tcp-2248 tcp-10133 tcp-25 tcp-9869 tcp-113 tcp-9871
tcp-10494 tcp-14059 tcp-10225 tcp-12404 tcp-10492 tcp-5644 tcp-4647
tcp-12400 tcp-12342 tcp-3297 tcp-10665 tcp-5626 tcp-10197 tcp-12402
tcp-9214 tcp-12336 tcp-11288 tcp-7604 tcp-9212 tcp-11286 tcp-10131
tcp-2250 tcp-11029 tcp-10541 tcp-10239 tcp-9862 tcp-14051 tcp-2246
tcp-12430 tcp-14968 tcp-2244 tcp-16300 tcp-12513 tcp-13393

This email was sent to:
dward@curriki.org,jwu@curriki.org,jmarks@curriki.org,jocelyn.cuasay@ap.att.c
om

If you have any questions concerning this email, call the number below
or reply to this email.
Thank you.

AT&T Managed Security Services
managed.security@ems.att.com
800-727-2222 prompt #8, #1