Re: Port 9284

From: Jyri Hovila (jyri.hovila_at_iki.fi)
Date: 09/24/03

  • Next message: Andrew McKnight: "RE: AIM Password theft" 
    Date: Wed, 24 Sep 2003 04:18:33 +0300
To: "Esler, Joel  Contractor" <joel.esler@rcert-s.army.mil>

    Hi!

    EJC> I have seen a sharp increase in scanning for port 9284. Veritas.. Anyone
    EJC> else experiancing similar?

    I assume you mean TCP. According to DShield it appears something (rather
    small) is going on:

    http://www.dshield.org/port_report.php?port=9284&recax=1&tarax=2&srcax=2&percent=N&days=40&Redraw=Submit

    It does show a clear spike, but on the other hand 4500 reported scans is
    not much concidering how many users report to DShield. None of my 10
    Snort sensors have catched scans to this port.

    Does anyone know what this port could generally be used for?

    - Jyri

    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: Andrew McKnight: "RE: AIM Password theft"

    Relevant Pages

    • SpeedStream 4200 Firewall to Syslog
      ... I am unable to figure out a way to make my SpeedStream put the Firewall ... log into ANY port so I can submit it automatically to DShield. ...
      (comp.security.firewalls)
    • Re: Port 50897?
      ... > Looking on Dshield it looks like activity on this port is ... > DShield does not show any registered apps for ... the logged IPs. ...
      (comp.security.firewalls)
    • Re: NOPROFILE is deprecated in favor of NO_PROFILE
      ... > and now if I want to upgrade any port I get the same ... > EJC ... Josh Tolbert ...
      (freebsd-questions)
    • Re: Port 50897?
      ... > There are no services open to the outside: port forwarding ... > 10.0.0.1 is the IP for the Winroute Firewall. ... > There is no reported activity for port 50897 by the Ipcop ... Looking on Dshield it looks like activity on this port is pretty low. ...
      (comp.security.firewalls)
    • Re: Change SSH port? why does this seem to be safer?
      ... "Barton L. Phillips" wrote in message ... > at port 22 will be logged in a manner that DShield can use for its ... How does DShield operate please, ...
      (comp.os.linux.security)