I'm analyzing a malware and I've noticed that it is doing some form of ephemeral port exhaustion.

My question: Is it normal for ephemeral ports in a Windows system to be selected in series (i.e. 50001, 50002, 50003, etc) or are they normally random?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.