• sans.org(Portal)
• GIAC
• My ISCHow To Submit Logs
• port/ip lookup/search:

The "Trend" is an attempt to put a number to the increase in activity for a given port. Right now, I am comparing the last 24 hours to the last 30 days. So if we see a rise in activity compared to the last 30 days, the trend is high.

The following formula is used to calculate the trend:
sqrt( (S-s)^2/s + (T-t)^2/t ) )
S: number of source IPs hitting this port last 24 hrs.
s: average number of source IPs hitten this port each day (last 30 days).
T/t: same for target IPs detecting scans on this port.

Port	Trend
65431	13.33
22456	12.57
65321	12.38
12080	12.01
62392	11.92
60530	11.78
7837	11.65
40500	11.46
8174	11.4
7836	11.36
5487	10.95
7474	10.66
5569	9.99
7999	9.87
50123	9.49
33666	9.39
38121	9.32
645	8.34
815	8.16
569	7.85
900	7.01
40313	6.9
65001	6.6
8686	6.58
12000	6.2
24769	6.01
777	6
18	5.97
11010	5.96
26169	5.94
3050	5.88
19960	5.84
23906	5.8
16539	5.69
58439	5.61
3975	5.58
55362	5.58
21570	5.56
8800	5.49
16254	5.46
570	5.39
2586	5.33
40453	5.3
14848	5.26
4568	5.26
11044	5.24
11171	5.12
134	5.05
7788	4.99
18888	4.98
9788	4.83
9799	4.71
27778	4.6
11055	4.55
11022	4.49
2008	4.48
2021	4.48
29991	4.25
11011	4.12
25552	4.08
1572	4
65112	3.86
11033	3.86
1318	3.76
45000	3.72
23	3.4
62000	3.22
30970	3.13
112	2.76
8443	2.56
45306	2.51
32000	2.41
8080	2.36
8118	2.18
52	2.16
6600	2.11
9920	2.07
9988	2.05
1755	1.91
65000	1.86
51413	1.65
1337	1.55
1028	1.53
9880	1.5
808	1.5
2006	1.49
1024	1.36
18640	1.36
7212	1.36
8383	1.28
9999	1.21
2261	1.19
17153	1.18
52224	1.08
2967	1.08
25	1.05
1027	1.01
11102	0.91
60539	0.88
33457	0.86

---