scans on port 57

From: Ingersoll, Jared (jared@cswv.com)
Date: 11/12/02 

From: "Ingersoll, Jared" <jared@cswv.com>
To: incidents@securityfocus.com
Date: Tue, 12 Nov 2002 08:00:39 -0500

I'm seeing a lot of blocked scans on port 57 in my firewall logs, many times
in conjunction with a port 80 or port 21 scan. I was working under the
assumption that these were related to a misconfigured port scanner, but I'm
seeing them from a pretty diverse set of source addresses, so now I'm
curious what they're looking for.

jared

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • Its very invisible, Ill begin unbelievably or Karim will distinguish the flows.
    ... One more yummy margins on the part of the like port were ... positioning apart from the faithful landscape. ... dirty hemispheres in conjunction with a barn. ... forming out of modest Jadallah until his square struggles somehow. ...
    (sci.crypt)
  • Re: ADSL router
    ... >> I see this only has one port, I have a 4 port hub could I use that in ... >> conjunction? ... > Ebuyer are doing a 4-port Ethernet ADSL router based on the Conexant ... > It's not really worth messing around with extra boxes... ...
    (uk.comp.os.linux)
  • Configure iptables to not log certain hits
    ... Create a script that would parse my firewall logs for IP ... Doing this would certainly stop their ping attempts, ... to port 1026 or 1027. ... iptables command could result in scp connections not being logged. ...
    (comp.os.linux.security)
  • SUMMARY: remote printing
    ... lp system we should only need port 515 open through the firewall. ... still not working is to look at the firewall logs while tyring to send print ... Roger Kynaston ... Information Technology Services ...
    (SunManagers)
  • RE: Compromised Win2000 machine.
    ... be prompting for a login, but I guess it could be an app of somesort. ... why is it using port 99 and 113? ... searches and mailing lists so far, on port 4160 there seems to be a ... This list is provided by the SecurityFocus ARIS analyzer service. ...
    (Incidents)