Re: Increase in traffic on port 20480 and 6667

["Pez Mohr" <boredMDer74 () msn com>]

Not a mIRC server, but IRC servers in general. There are other clients than
mIRC, such as PIRCH, vIRC, BitchX, etc.

Pez Mohr
boredMDer74 () msn com
Aspiring BOFH


----- Original Message -----
From: "dsardina" <dsardina () si rr com>
To: "Kip Sr." <kipsr1 () yahoo com>; <security-basics () securityfocus com>
Sent: Tuesday, October 15, 2002 4:41 PM
Subject: Re: Increase in traffic on port 20480 and 6667


> I dont know much about port 20480, but 6667 is an attempt to connect to a
> mIRC Server.
>
> I dont know if 192.168.0.199 is a router IP or a pc, but if its a pc,
> check to see if that pc has any IRC Server Software is installed.
>
> (6667) is default port for a irc server.//
>
> Just my 2 cents
> Good Luck~
>
> DS-
>
>
> ----- Original Message -----
> From: "Kip Sr." <kipsr1 () yahoo com>
> To: <security-basics () securityfocus com>
> Sent: Thursday, October 10, 2002 3:16 PM
> Subject: Increase in traffic on port 20480 and 6667
>
>
> > Hi there,
> >
> > In the past few days, my IDS has been picking up
> > traffic coming from port 20480 (on Internet servers)
> > to port 6667 (internal desktops). Both ports are
> > commonly used by trojan horse programs. Has anyone
> > else seens this?
> >
> > 10/10-11:50:01.977897 204.x.x.x:20480 ->
> > 192.168.0.199:6667
> > TCP TTL:255 TOS:0x10 ID:0 IpLen:20 DgmLen:195
> >
> >
> > Thanks,
> > Kip Sr.
> >
> > __________________________________________________
> > Do you Yahoo!?
> > Faith Hill - Exclusive Performances, Videos & More
> > http://faith.yahoo.com