Re: Port 3060? What in the hell is going on?

From: Duane Arnold (Notme_at_Notme.com)
Date: 12/02/04

  • Next message: Don Wright: "Re: VNC via VPN or no VPN?" 
    Date: Thu, 02 Dec 2004 11:28:11 GMT

    Charles Newman wrote:

    >
    > "Arthur Hagen" <art@broomstick.com> wrote in message
    > news:coimf2$5ol$1@cauldron.broomstick.com...
    >> Charles Newman
    >> <charlesnewman1@comcast.net.spammers.will.be.shot.on.sight> wrote:
    >> > Why am I being attacked on port 3060? I am
    >> > suddenly getting hammered with all kinds of
    >> > connect attempts on port 3060? What is on
    >> > port 3060 they are looking for? Tiny Firewall
    >> > alerted me to connect attempts on that
    >> > port and I was able to block it. Score another
    >> > one for Tiny Firewall. Those of you with
    >> > hardware appliances are probably being
    >> > probed on port 3060 right now, and you
    >> > would not know it, if it were not for this
    >> > post. Better keep an eye on inbound
    >> > port 3060. Somebody is trying to do
    >> > who-knows-what on that port.
    >>
    >> Nope, nothing there. 1032 TCP port probes since yesterday, and not a
    > single
    >> one to that port. Could it be that you have someone on the *inside*
    > running
    >> a service that expects return traffic to port 3060, which is blocked?
    >> Prime candidates for something like this happening include file sharing
    >> programs.
    >
    > I dont allow file sharing anymore, since the RIAA
    > decided to go after file sharers. I know that 3060 is
    > in the range of ports (80, 1000-5300), that Kazaa
    > uses, but since I do not use or allow Kazaa anywhere
    > on my network, there is no reason that someone
    > should be connecting on that port.
    > If you want to block Kazaa on your network,
    > Tiny Personal Firewall on an ICS box is the ONLY
    > way you can do it. Everything on my network has
    > to go through either Socks or HTTP proxies. On the
    > Socks proxy, I block outgoing calls to port 80,
    > and ports 1000-5300, and that effectively shuts
    > down Kazaa. Tiny can control access by specific
    > application. Try THAT on your hardware
    > appliances.

    What are you talking about here? I would simply find out the IP(s) for the
    Kazaa site and set rules with my Watchguard FW appliance and block all
    inbound and outbound traffic with the Kazaa site and be done with it. Kazaa
    can run all it wants on any machine it wants and it would nerver be able to
    make contact with the site. Kazza wouldn't be on any of the machines on my
    network period in the first place. And a network FW's job is not to be
    running some kind of BS Appliaction Control trying to stop anything at the
    machine level.

    > I can tell Tiny to block any outgoing
    > calls, for example, on port 80 as part of blocking
    > Kazaa, while telling it to allow port 80 calls on the
    > HTTP proxy. You can say all you like, but Tiny
    > can do a lot of things a hardware appliance just
    > cannot do. Your hardware appliances, since they
    > are not part of the sever machine, cannot block
    > by specific application. A FW solution installed on
    > the server machine can do this. So, in short, Tiny
    > Firewall is NOT A TOY, contarry to what one
    > poster has said here.

    Tiny is a PFW solution and not a network FW solution. I wouldn't be using
    Tiny or anyother PFW solution trying to proctect something like IIS, SQL
    Server etc, etc running on machines on my network. There would be a FW
    appliance setting there, a NAT router or deticated computer for running a
    network FW solution and not some personal FW such as Tiny.

    As for the rest of your post, you at least had the common sense to start
    using a NT class machine.

    Duane :)

  • Next message: Don Wright: "Re: VNC via VPN or no VPN?"

    Relevant Pages

    • [fw-wiz] Re: Blocking Kazaa
      ... deal with Kazaa, AIM, Yahoo IM, MS Messgener, Chat, etc. ... > TCP and UDP packets going to port 1214 and also, oddly enough, sourcing from ... > Organization: Network Penetration ... > I would love to hear if someone has a way to block it with a PIX. ...
      (Firewall-Wizards)
    • Re: Cant get out on port 80
      ... >>I have an appliance hooked up that needs to send packets out on port 80. ... The ISA service is not running. ... Have you sniffed the network traffic before and after the router? ...
      (microsoft.public.security)
    • Re: Strange back-orifice looking scan...
      ... Port 1214 used by Kazaa aka Morpheus, this is obviously the remote port that ... a/ He/she has somehow manipulated Kazaa to scan not for other Kazaa users on ... actively portscanning either your network I wasnt sure if it was a network ... MSN Photos is the easiest way to share and print your photos: ...
      (Incidents)
    • Re: Routing a subdomain....how?
      ... We recently have an appliance that sits on our network but needs access to the internet. ... All incoming port 80 traffic is pointed there. ... I have ran the Email and Internet wizard to allow the port to be opened on the BSB firewall, ...
      (microsoft.public.windows.server.sbs)
    • Re: question about "discovering" a device on a network.
      ... We're working on a small appliance that has a linux/unix installed on ... The device needs an IP address so then the client can connect to the ... Uses nmap to do a full network scan and try to figure out which device ... Your device can open a specific port for listening, and the discovery program can broadcast a message to that port. ...
      (comp.os.linux.embedded)