Re: Ports 1030, 1031, 1032

[Robert Baskerville <Robert () Baskerville Net>]

Matthew Ritenburg <mattr () burlee com> wrote:

> What purpose do ports 1030-1032 server under WinNT Svr 4.0?  I undertand
> what the ports are a far as /etc/services go, but,  I'm not sure why they
> would be open under NT.  As far as I know, the ports relate to some BBN
> protocol.  Will closing these ports break anything in NT?

I think /etc/services is a red herring here :-)

If you have IIS running then you will probably find that upon startup of the
service, it grabs a port around 1030 for some remote admin facility.

This can be annoying (if you use NT, that is) since there is a very simple
100% CPU usage DOS attack against this admin facility.

If you need to run IIS, use your firewall (if you have one) to prevent access
to these ports. If you DON'T need to run IIS then don't! (How about Apache?)

Robert Baskerville
Robert () Baskerville Net