I've been watching my logs (Ubuntu 9.10 server) and dunno about any of you but I am getting a ton of traffic from sources like Russia, Romania, etc.. on port 11370 (my iptables are logndrop'ing it. But was just curious).
Some googling revealed this info:
http://www.keysigning.org/sks/ -which seems to use port 11370 & 11371
Could that be the service they are scanning for (i don't run it)?
ICS shows this: https://isc.incidents.org/port.html?port=11370
Just curious what you guys think and if anyone has seen this before? If need be I can post my log on here, but its just a dropped log of TCP port 11370 from various IPs.
Thought it was strange as thats the ONLY Port I seem to repeatedly be hit on (from logs).
I'm running on a Linode (VPS) if that matters to annyone.