Take a look at the destination port in the first log entry on the slide. Port 22 means Secure Shell
(SSH), right? Not quite, since in this case the transport protocol is UDP, which is not generally used
for SSH traffic. A UDP port 22 connection attempt, especially when followed by an almost
immediate connection to UDP port 5632 is almost always indicative of a pcAnywhere probe.