RE: Does Windows NT use TCP port 2000/2001?

From: Margulis, Scott (samargul@nps.navy.mil)
Date: 10/19/01 

Message-ID: <72FF0DA66828EF42B297D26E4FDFCDE6C855B4@Saipan.ad.nps.navy.mil>
From: "Margulis, Scott" <samargul@nps.navy.mil>
To: "'Devin L. Ganger '" <devin@thecabal.org>, "'focus-ms@securityfocus.com '" <focus-ms@securityfocus.com>
Subject: RE: Does Windows NT use TCP port 2000/2001?
Date: Fri, 19 Oct 2001 09:29:21 -0700

http://www.networkice.com/advice/Exploits/Ports/
http://www.iana.org/assignments/port-numbers

Check out these sites... They tell you common uses for various ports...
I don't recall these ports being used by NT 4.0.

Scott Margulis
MCSE+I

-----Original Message-----
From: Devin L. Ganger
To: focus-ms@securityfocus.com
Sent: 10/18/01 4:29 PM
Subject: Does Windows NT use TCP port 2000/2001?

I'm looking over the results of a port scan for a client with a couple
of exposed NT 4.0 boxes, and on both boxes I see that TCP port 2000 is
open; on one box, TCP 2001 is also open.

The most information I've been able to find out about these ports
after a couple of days of digging is that 2000 is "callbook" and
2001 is "dc".

I don't recall seeing these ports open on any other NT box I have
scanned, and I don't have NT boxes ready to hand.

Does anyone know if these are legitimate ports to be open, and if
not, what they're likely to indicate? Neither box is running IIS,
nor are they running any applications in common. 

-- 
Devin L. Ganger <devin@thecabal.org>
A man, a miss, a car -- a curve,
He kissed the miss and missed the curve -- Burma Shave (1948)

Relevant Pages

  • Re: IPSec and TCP/IP filtering
    ... I assume you're also going to want to allow access to TCP and UDP ports 53 ... I would say this is a pretty strict port filtering scheme you're setting up. ... You need to set up filter that will allow access to TCP port 80 and deny ...
    (microsoft.public.win2000.security)
  • Re: Generic Host Process for Win32 Services Error
    ... allows remote code execution on ports 139 and 445. ... | any suggestion to trace the source of this buffer overflow infection? ... Read the included PDF Help File on the use of a surrogate PC to download all files ... TCP port 135 or ...
    (microsoft.public.security.virus)
  • Re: pcAnywhere..thru firewall??
    ... an identity claiming to be Patrick Farrell ... >>>To allow this application through a firewall, ... you should only need to permit the TCP port. ... >> has information on changing the ports if you need to as well. ...
    (comp.security.firewalls)
  • Re: VPN port numbers
    ... PPTP and L2TP are TCP port. ... 43 is IP protocol. ... you don't need to open the GRE. ... the ports I need to forward on the router are: ...
    (microsoft.public.windowsxp.network_web)
  • Re: why isnt the set of open ports a security problem?
    ... secondary UDP connections dynamically assigned to ports ... also mentions dynamic assignment of a TCP port by the ...
    (microsoft.public.internet.netmeeting)