[dns-operations] udp/49153

[Marcin Antkiewicz]

> isc.sans.org says they might be SCADA related.
> http://isc.sans.org/port.html?port=49153

Good evening,

If the traffic is modbus ascii, the frames should begin with  0x3A and
end with 0x0D0A, with values from 0x30 to 0x45 as payload.

I would love to get the dumps.

Given the number of sources, that (in my experience) PLCs are almost
always installed in private IP space and that modbus ascii is very
rare, I doubt this traffic is a case of data leak from a sensor
network.

--
Marcin Antkiewicz