Re: Ports 4162-4335

From: Jon (no@spam.com)
Date: 11/26/02 

From: "Jon" <no@spam.com>
Date: Tue, 26 Nov 2002 00:30:17 -0000

Hi Sky,

I haven't got these ports open; my firewall caught and reported these scans.
It was something I haven't seen before and looked similar to a hack.

There were about 180 scans in 15 mins. They started on 4162 and increased to
4342. Some numbers were skipped and every now and then a 1952 was thrown in.
The source address varied from DNS servers to video servers to unknown IPs.
Not really consistant.

Although odd my guess is that this traffic was not malicious as I had just
inherited a new IP address. Presumably the computer that was using the
address before was some sort of server. But, like you, I haven't found
anywhere which states what uses this ports. They're just listed by IANA, etc
as "Unassigned".

It's been several days now on the new IP address and I haven't had a repeat
run. However, I am still curious as to what this traffic is.

If you can find any more info please let me know.

Thanks.

""Sky Ingram [MS]"" <skyingramonline@microsoft.com> wrote in message
news:Z59#6SMlCHA.1676@cpmsftngxa08...
> Hello Jon,
>
> I don't find any information regarding what specifically might require
> these ports. I also come up empty on research regarding mpnjsc.
> Is there a particular reason that you have these ports open?
>
> Thanks,
> Sky Ingram
> Microsoft Online Support
> Microsoft Corporation
>
> Get Secure! - <www.microsoft.com/security>
>
> This posting is provided "AS IS" with no warranties, and confers no rights
>

Relevant Pages

  • Re: Hack Attempt on Windows 2003 AD Native
    ... If you have a firewall then all is good. ... > Source IPs of machines trying to hack my servers... ... > they were attempting to connect again but using the NEW Admin account I ...
    (microsoft.public.windows.server.active_directory)
  • Re: Hack Attempt on Windows 2003 AD Native
    ... If you have a firewall then all is good. ... > Source IPs of machines trying to hack my servers... ... > they were attempting to connect again but using the NEW Admin account I ...
    (microsoft.public.win2000.active_directory)
  • RE: Slow user logon on Terminal server after migration to Windows 2003
    ... The Terminal Servers are 2000 or 2003. ... "Inside the firewall zone" means that the Citrix Servers have a firewall ... available RPC ports? ...
    (microsoft.public.windows.server.active_directory)
  • Re: medical records, web server, & stateful firewall vs packet filter
    ... > image and SQL servers directly (the image server link in particular ... The image and SQL servers ... the 2 firewall layers should run different s/ware - the idea is that a major ... security always cost a lot more than you expect (this comes up whenever we ...
    (comp.dcom.sys.cisco)
  • Re: I have been hacked (WAS: Have I been hacked or is nmap wrong?)
    ... > console based ftp client. ... the FTP servers have? ... > They are really mail servers, at least smtp for outgoing mails ... If you're firewall was dropping incoming packets destined to ...
    (freebsd-questions)
Quantcast