Re: Help - what is port 666 (DOOM) and why?

From: Daniel Crichton (news_at_worldofspack.co.uk)
Date: 10/01/03 

Date: Wed, 1 Oct 2003 14:16:47 +0100

David <davidwnh@adelphia.net> wrote:
> It has everything to do with filenames. And everything to do with
> commonly assigned ports. Here's a good clear example:

Filenames are irrelevant. Port names are irrelevant. Any program can be
named anything and use any port.

> When your firewall puts up an alert that states that iexplore.exe is
> trying to access xxx.xxx.xxx.xxx on port 80(http) what is your
> average joe who doesn't know anything about port assignments but
> knows that his browser uses the http protocol going to do?

Granted, this makes sense, as does your IRC example. But you've taken a very
narrow view of this. "OMG, iexplore.exe is trying to connect to port 1080
(socks), Internet Explorer has nothing to do with socks, therefore it must
be very bad!!!" - one example from a user I had to deal with recently who
calmed down once I explained port 1080 is commonly used for proxy servers,
and they asked me why it said socks and not proxy, took a bit of explaining
and I'm still not convinced they took it onboard. There is no longer a
single, standardised list of ports and common names - the firewall
developers just seem to pick one and use that. I've seen port lists showing
13 as Daytime, yet I've always known this as Ident. When was the last time
you saw a daytime service, or needed to access it? Yet Ident is very common,
and average joe user connecting up to IRC will commonly come across hits to
their firewall for port 13. A search on Google for Ident is going to much
more useful to them than a search for Daytime.

> assignments happens to know what IRC is? Some may be just as confused
> as you but others won't be.

I never said I was confused. I was merely pointing out that a firewall
popping up a name to go with port for something that hasn't been seen for
years may be confusing to average/less than average joe user. Why did the
OP's firewall software use the name Doom for port 666 when it could also
have used mdqs, or satansbackdoor, or a whole list of other names that in
the past have been associated with this port. For very common port numbers I
agree that names are useful, but for those rarely seen the arbitrary
selection of 1 name only serves to confuse or panic people, especially when
the name used implies something "nasty".

Dan

Relevant Pages

  • Re: IIS5.0 and SSL
    ... start with the most common issues and assume they haven't been done. ... If you are able to get to the server from the server console using ... You could ask the firewall administrator to check ... >>and change which sites are bound to port 443 on which IP ...
    (microsoft.public.inetserver.iis.security)
  • RE: [Full-Disclosure] A rather newbie question
    ... show a few different ports but port 60096 stands out. ... Common name: client-port on Red Hat Linux 9.0, Fedora Core 1, Red Hat ... Outgoing client connections from systems. ...
    (Full-Disclosure)
  • Re: International Battery Charger?
    ... flagged vessel calling In nearly every port from San Remo to Messina. ... Adaptors and Italian hardware stores occupied a large chunk of my time ... Italy when they aren't but they are common at any Radio Shack and ...
    (rec.photo.digital.slr-systems)
  • RE: [Full-Disclosure] A rather newbie question
    ... show a few different ports but port 60096 stands out. ... Common name: client-port on Red Hat Linux 9.0, Fedora Core 1, Red Hat ... Outgoing client connections from systems. ...
    (Full-Disclosure)
  • Re: [Full-Disclosure] A rather newbie question
    ... show a few different ports but port 60096 stands out. ... Common name: client-port on Red Hat Linux 9.0, Fedora Core 1, Red Hat ... Outgoing client connections from systems. ...
    (Full-Disclosure)