<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
h1
{mso-style-priority:9;
mso-style-link:"Título 1 Car";
margin-top:6.0pt;
margin-right:0cm;
margin-bottom:6.0pt;
margin-left:0cm;
page-break-after:avoid;
font-size:16.0pt;
font-family:"Times New Roman",serif;
color:#002060;
letter-spacing:1.0pt;
font-weight:bold;}
h2
{mso-style-priority:9;
mso-style-link:"Título 2 Car";
margin-top:6.0pt;
margin-right:0cm;
margin-bottom:6.0pt;
margin-left:0cm;
page-break-after:avoid;
font-size:14.0pt;
font-family:"Times New Roman",serif;
color:#943634;
letter-spacing:1.0pt;
font-weight:bold;}
h3
{mso-style-priority:9;
mso-style-link:"Título 3 Car";
margin-top:10.0pt;
margin-right:0cm;
margin-bottom:0cm;
margin-left:0cm;
margin-bottom:.0001pt;
page-break-after:avoid;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:#365F91;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
pre
{mso-style-priority:99;
mso-style-link:"HTML con formato previo Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoNoSpacing, li.MsoNoSpacing, div.MsoNoSpacing
{mso-style-priority:1;
margin:0cm;
margin-bottom:.0001pt;
font-size:9.0pt;
font-family:Consolas;
color:windowtext;
mso-fareast-language:ES;}
p.MsoQuote, li.MsoQuote, div.MsoQuote
{mso-style-priority:29;
mso-style-link:"Cita Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Times New Roman",serif;
color:gray;
font-style:italic;}
span.Ttulo1Car
{mso-style-name:"Título 1 Car";
mso-style-priority:9;
mso-style-link:"Título 1";
font-family:"Arial",sans-serif;
color:#002060;
letter-spacing:1.0pt;
font-weight:bold;}
span.Ttulo2Car
{mso-style-name:"Título 2 Car";
mso-style-priority:9;
mso-style-link:"Título 2";
font-family:"Arial",sans-serif;
color:#943634;
letter-spacing:1.0pt;
font-weight:bold;}
span.Ttulo3Car
{mso-style-name:"Título 3 Car";
mso-style-priority:9;
mso-style-link:"Título 3";
font-family:"Arial",sans-serif;
color:#365F91;
font-weight:bold;}
span.CitaCar
{mso-style-name:"Cita Car";
mso-style-priority:29;
mso-style-link:Cita;
font-family:"Arial",sans-serif;
color:gray;
font-style:italic;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
span.HTMLconformatoprevioCar
{mso-style-name:"HTML con formato previo Car";
mso-style-priority:99;
mso-style-link:"HTML con formato previo";
font-family:Consolas;
color:black;}
span.EstiloCorreo27
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#002060;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:886603673;
mso-list-type:hybrid;
mso-list-template-ids:-1133617598 612034182 201981955 201981957 201981953 201981955 201981957 201981953 201981955 201981957;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l1
{mso-list-id:1866672357;
mso-list-type:hybrid;
mso-list-template-ids:-2018221036 -627303464 201981955 201981957 201981953 201981955 201981957 201981953 201981955 201981957;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:18.0pt;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=ES-AR link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=ES style='font-size:14.0pt;font-family:"Calibri",sans-serif;color:#002060;mso-fareast-language:EN-US'>Muy bueno!<o:p></o:p></span></p><p class=MsoNormal><span lang=ES style='font-size:14.0pt;font-family:"Calibri",sans-serif;color:#002060;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=ES style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext'>De:</span></b><span lang=ES style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext'> lista-bounces@arnog.com.ar <lista-bounces@arnog.com.ar> <b>En nombre de </b>Hernan Moguilevsky - NOC CABASE<br><b>Enviado el:</b> viernes, 8 de junio de 2018 9:24 a.m.<br><b>Para:</b> lista@arnog.com.ar<br><b>Asunto:</b> Re: [Lista ArNOG] (INFO) TOP 10 port-scan en una subnet Honeypot<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p>Muy buena data!<o:p></o:p></p><p>Gracias Ivan!<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On 08/06/18 01:04, Ivan Chapero wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div><pre>Estimados,<o:p></o:p></pre><pre>les comparto el TOP10 de dst-port registrados en un nuevo prefix que decidí dejar a modo de pseudo-honeypot unas semanas antes de asignarlo a dispositivos (un nuevo prefijo que comienza a anunciarse por BGP pero que nunca fue utilizado): (<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Top 10 Dst Port ordered by flows:<o:p></o:p></pre><pre>Date first seen Duration Proto Dst Port Flows(%) Packets(%) Bytes(%) pps bps bpp<o:p></o:p></pre><pre>2018-06-07 13:22:57.426 40266.293 any 23 307885(22.7) 335206(21.2) 14.3 M(15.1) 8 2842 42<o:p></o:p></pre><pre>2018-06-07 13:23:55.842 40199.311 any 8291 232840(17.2) 233391(14.8) 9.6 M(10.2) 5 1908 41<o:p></o:p></pre><pre>2018-06-07 13:23:55.861 40199.558 any 7547 114526( 8.4) 114575( 7.2) 4.7 M( 5.0) 2 936 41<o:p></o:p></pre><pre>2018-06-07 13:23:57.184 40196.248 any 22 35951( 2.7) 57111( 3.6) 3.0 M( 3.2) 1 599 52<o:p></o:p></pre><pre>2018-06-07 13:41:12.870 32120.399 any 37215 31069( 2.3) 31108( 2.0) 1.3 M( 1.3) 0 313 40<o:p></o:p></pre><pre>2018-06-07 13:24:22.717 40137.509 any 5060 23830( 1.8) 23831( 1.5) 10.0 M(10.5) 0 1985 417<o:p></o:p></pre><pre>2018-06-07 13:23:58.597 40189.223 any 8080 17939( 1.3) 18187( 1.2) 739032( 0.8) 0 147 40<o:p></o:p></pre><pre>2018-06-07 13:23:58.590 40242.250 any 80 17233( 1.3) 21017( 1.3) 912863( 1.0) 0 181 43<o:p></o:p></pre><pre>2018-06-07 13:23:55.930 40207.759 any 445 16619( 1.2) 20269( 1.3) 1.0 M( 1.1) 0 203 50<o:p></o:p></pre><pre>2018-06-07 13:23:56.590 40198.672 any 8545 16046( 1.2) 16046( 1.0) 642020( 0.7) 0 127 40<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Claramente el default-port de WINBOX se convirtió en favorito en estos días, destronando a varios viejos consagrados :D.<o:p></o:p></pre><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>Saludos!</span><span style='font-family:"Tahoma",sans-serif'><br clear=all><o:p></o:p></span></p></div><p class=MsoNormal><br>-- <o:p></o:p></p><div><div><p class=MsoNormal><b>Ivan Chapero<br></b><b><span style='color:#666666'>Área Técnica y Soporte</span></b><span style='color:#666666'> <br>Fijo: 03464-470280 (interno 535)</span> | <span style='color:#666666'>Móvil: 03464-155-20282</span> | <span style='color:#666666'>Skype ID: ivanchapero</span> <o:p></o:p></p><div><p class=MsoNormal><span style='color:#666666'>--</span><o:p></o:p></p><p class=MsoNormal align=center style='text-align:center'><span style='color:#666666'>GoDATA Banda Ancha - CABLETEL S.A. | Av. 9 de Julio 1163 - 2183 - Arequito - Santa Fe - Argentina</span><o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><br><br><br><br><br><br><o:p></o:p></p></div></div></div></div><p class=MsoNormal><br><br><br><o:p></o:p></p><pre>_______________________________________________<o:p></o:p></pre><pre>Lista mailing list<o:p></o:p></pre><pre><a href="mailto:Lista@arnog.com.ar">Lista@arnog.com.ar</a><o:p></o:p></pre><pre><a href="http://mailmancabase.interdotnet.com.ar/mailman/listinfo/lista">http://mailmancabase.interdotnet.com.ar/mailman/listinfo/lista</a><o:p></o:p></pre></blockquote><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>-- <o:p></o:p></p><div><table class=MsoNormalTable border=1 cellspacing=10 cellpadding=0 width="100%" style='width:100.0%;border:none;border-top:solid #A2C3E3 2.25pt'><tr><td width=215 valign=top style='width:150.0pt;border:none;padding:0cm 0cm 0cm 0cm'><p class=MsoNormal align=right style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:right'><img border=0 width=200 height=163 style='width:2.0833in;height:1.6979in' id="_x0000_i1025" src="http://www.cabase.org.ar/mail/logo_cabase.png" alt=Logo><o:p></o:p></p></td><td valign=top style='border:none;padding:7.5pt 7.5pt 7.5pt 7.5pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:13.5pt;font-family:"Arial",sans-serif;color:#05233D'>Hernan Moguilevsky</span><br><i><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:#90A7B5'>NOC CABASE</span></i><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:#05233D'>Cámara Argentina de Internet</span><br><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:#416886'>Suipacha 128 - 3 "F"</span> <span style='font-size:10.0pt;font-family:"Arial",sans-serif;color:#416886'>- Tel: (5411) 5263-7456 ext. 109</span><br><span style='font-size:10.0pt;font-family:"Arial",sans-serif;color:#1B4260'><a href="mailto:noc.pablo@cabase.org.ar">noc.@cabase.org.ar</a> · <a href="http://www.cabase.org.ar/">www.cabase.org.ar</a></span><o:p></o:p></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0><tr><td style='padding:3.75pt 3.75pt 3.75pt 3.75pt'><p class=MsoNormal style='margin-top:7.5pt;mso-margin-bottom-alt:auto'><a href="http://www.facebook.com/CabaseAr/"><span style='text-decoration:none'><img border=0 width=24 height=24 style='width:.25in;height:.25in' id="_x0000_i1026" src="http://www.cabase.org.ar/mail/logo_fb.png" alt=facebook></span></a><a href="http://twitter.com/CabaseAr"><span style='text-decoration:none'><img border=0 width=24 height=24 style='width:.25in;height:.25in' id="_x0000_i1027" src="http://www.cabase.org.ar/mail/logo_twiter.png" alt=twitter></span></a><a href="http://www.linkedin.com/company/562172?trk=tyah&trkInfo=clickedVertical:company,clickedEntityId:562172,idx:2-1-2,tarId:1454513596509,tas:cabase"><span style='text-decoration:none'><img border=0 width=24 height=24 style='width:.25in;height:.25in' id="_x0000_i1028" src="http://www.cabase.org.ar/mail/logo_li.png" alt=linkedIn></span></a><o:p></o:p></p></td></tr></table></td></tr><tr><td colspan=2 valign=top style='border:none;border-top:solid #DBEAE7 1.5pt;padding:11.25pt 0cm 0cm 0cm'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:9.0pt;font-family:"Arial",sans-serif;color:#90A7B5'><img border=0 width=14 height=14 style='width:.1458in;height:.1458in' id="_x0000_i1029" src="http://www.cabase.org.ar/mail/logo_leaf.png" alt=eco>No me imprimas si no es necesario. Protejamos el medio ambiente</span><o:p></o:p></p></td></tr></table><p class=MsoNormal><span style='color:windowtext'><o:p> </o:p></span></p></div></div></div></body></html>