Open MS-SQL Server Resolution Service Report

This report identifies hosts that have the MS-SQL Server Resolution Service running and accessible on the Internet.

These services have the potential to expose information about a client’s network on which this service is accessible and the service itself can be used in UDP amplification attacks.

For more details behind the scan methodology and a daily update of global MS-SQL Server Resolution Service scan statistics please visit our dedicated MS-SQL Server Resolution Service scan page.

For more information on our scanning efforts, check out our Internet scanning summary page.

Filename(s): scan_mssql

Fields

  • timestamp
    Time that the IP was probed in UTC+0
  • ip
    The IP address of the device in question
  • protocol
    Protocol that the MS-SQL response came on (usually UDP)
  • port
    Port that the MS-SQL response came from (usually 1434)
  • hostname
    Reverse DNS name of the device in question
  • tag
    Will always be mssql
  • asn
    ASN of where the device in question resides
  • geo
    Country where the device in question resides
  • region
    State / Province / Administrative region where the device in question resides
  • city
    City in which the device in question resides
  • naics
    North American Industry Classification System Code
  • sic
    Standard Industrial Classification System Code
  • server_name
    The ServerName field in the response — this is usually the NetBIOS name of the server
  • instance_name
    The InstanceName field in the response — this is the name of the SQL instance on the server
  • version
    Version number of the running MS-SQL / SQLExpress service
  • tcp_port
    The TCP port that you would use to connect to the MS-SQL instance
  • named_pipe
    The named pipe that the SQL server is advertising
  • response_length
    Length of the response from the MS-SQL Server Resolution Service (including packet headers)
  • amplification
    Amplification factor (This amplification is is based solely on the payload size sent and payload size received)

Sample

"timestamp","ip","protocol","port","hostname","tag","version","asn","geo","region","city","naics","sic","server_name","instance_name","tcp_port","named_pipe","response_length","amplification","sector","amplification"
"2010-02-10 00:00:00",192.168.0.1,udp,1434,node01.example.com,mssql,14.0.1000.169,64512,ZZ,Region,City,0,0,SERVERGT,SQLEXPRESS,50995,,410,410.00,"Communications, Service Provider, and Hosting Service",410.00
"2010-02-10 00:00:01",192.168.0.2,udp,1434,node02.example.com,mssql,12.0.2000.8,64512,ZZ,Region,City,0,0,WIN-86VSSQPM8CC,ILUO,1433,,230,230.00,"Communications, Service Provider, and Hosting Service",230.00
"2010-02-10 00:00:02",192.168.0.3,udp,1434,node03.example.com,mssql,15.0.2000.5,64512,ZZ,Region,City,0,0,SERWER,INSERTGT,1433,,220,220.00,,220.00

Our 118 Report Types

« Back to Network Reporting