(Reposted to the list *with* Simons permission): Simon Lyall wrote:

...

If you looked at the "top ports" you'll see 135, 139, 445 make an appearance which are used by various windows worms, so obvious some users are infected with virii. However this isn't going to push peoples port counts up to the 1,000's like p2p will.

Have you got numbers for each port as well as the combos? Something like:

Port 25 - 70% Port 80 - 75% Port 443 - 56%

/--- Percentage of IP's that sent a packet on this port | /------ Port number v v 98.11 80/tcp 98.09 53/udp 95.64 443/tcp 73.63 110/tcp 60.43 25/tcp 41.83 123/udp 36.18 22/tcp <-- ! 33.89 7001/udp 33.62 1433/tcp 33.22 5900/tcp 32.81 6000/tcp 31.07 139/tcp 30.86 445/tcp 30.60 135/tcp 26.40 21/tcp 25.73 2967/tcp 25.42 8080/tcp 23.79 42/tcp 21.62 10000/tcp 20.84 9/udp <-- wtf? 19.62 6346/tcp 19.49 1863/tcp 17.31 1080/tcp 16.98 6346/udp 15.49 3389/tcp 15.14 10827/tcp 14.83 10929/tcp 13.94 26200/tcp 13.22 6348/udp 12.92 6348/tcp 12.48 15118/tcp 11.99 20000/tcp 11.41 12350/udp 11.32 8000/udp 11.21 6881/tcp 11.02 80/udp 10.84 5800/tcp 10.84 5000/tcp 10.62 7001/tcp