TCP probe on port 35540 from port 1

From: Paul Gear (paulgear@bigfoot.com)
Date: 07/25/01 

Message-ID: <3B5F38AA.53EF09B6@bigfoot.com>
Date: Thu, 26 Jul 2001 07:22:50 +1000
From: Paul Gear <paulgear@bigfoot.com>
To: SecurityFocus Incidents List <incidents@securityfocus.com>
Subject: TCP probe on port 35540 from port 1

Anyone seen a probe like this lately?

Jul 23 11:45:53 ### kernel: Packet log: input DENY ppp0 PROTO=6
172.185.150.94:1 ###:35540 L=40 S=0x00
I=2815 F=0x0000 T=35 (#66)

This was the only packet of its type, and there didn't seem to be
anything else happening at the time. The source address looks up to
ACB9965E.ipt.aol.com.

As there is no SYN flag, it seems this is from some sort of
cracking/security tool, but i'm not sure what. The source port of
tcpmux is curious.

Paul
http://paulgear.webhop.net

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • vb.net and sockets
    ... Why does a VB.NET UDP socket send data on a random port?. ... I send a UDP packet to a remote machine that responds back via ... UDP with some data in the packet. ... back to me on the original source port, so of course my bind doesn't work. ...
    (microsoft.public.dotnet.languages.vb)
  • Re: vb.net and sockets bug?
    ... This will bind the socket to the local port 1234, ... 'packet is transmitted to 192.168.0.100 with a source dest port of 9001 and a source send port of 2039. ... The packets destination port is correct, but the packets source port it is actually sent from is random. ...
    (microsoft.public.dotnet.general)
  • Re: vb.net and sockets bug?
    ... Changing the bind to 1234 does bind PART of ... the local port 1234. ... with a simple UDP packet. ... REAL send source port the VB program sent it on which is NOT 9001, ...
    (microsoft.public.dotnet.general)
  • Re: what does this mean ? (inside,outside)
    ... I would like to setup af port forwording for my vnc. ... But in answer to the question: the interface pair is optional ... packet is a TCP packet and the destination port is 3389, ... then the packet should be rewritten so that the source port is 3389 ...
    (comp.dcom.sys.cisco)
  • Re: RIPE Probes from Port 80 to Port 32xxx
    ... :I am getting hit with probes from RIPE airspace port 80 to my port 32xxx, ... "Another type of packet is unconditionally dropped, ... to try to circumvent firewalls. ... The source port of 80 could be to try to get around naive filters that ...
    (comp.security.misc)