Full Disclosure mailing list archives
Re: TCP Port 42 port scans? What the heck over...
From: "Daniel F. Chief Security Engineer -" <danielf () supportteam net>
Date: Mon, 13 Dec 2004 11:52:28 -0600
Port 42 is the WINS port, and if im not mistaken last week or the week before that an exploit was released for it, thats probably your culprit for the increased port 42 traffic levels. http://support.microsoft.com/default.aspx/kb/890710 On Monday 13 December 2004 07:46, James Lay wrote:
Here they be. ODD. Anyone else seeing this? Dec 13 06:41:49 gateway kernel: Web netrecall drops:IN=br0 OUT=br0 PHYSIN=eth1 PHYSOUT=eth0 SRC=131.252.116.141 DST=10.1.19.1 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=57370 DF PROTO=TCP SPT=6000 DPT=42 WINDOW=65535 RES=0x00 SYN URGP=0 Dec 13 06:41:49 gateway kernel: Web1 drops:IN=br0 OUT=br0 PHYSIN=eth1 PHYSOUT=eth0 SRC=131.252.116.141 DST=10.1.18.1 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=57370 DF PROTO=TCP SPT=6000 DPT=42 WINDOW=65535 RES=0x00 SYN URGP=0 Dec 13 06:41:49 gateway kernel: Web netrecall drops:IN=br0 OUT=br0 PHYSIN=eth1 PHYSOUT=eth0 SRC=131.252.116.141 DST=10.1.19.4 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=57370 DF PROTO=TCP SPT=6000 DPT=42 WINDOW=65535 RES=0x00 SYN URGP=0 Dec 13 06:41:49 workbox kernel: IN=eth0 OUT= MAC=00:60:97:a5:76:36:00:10:7b:90:bc:30:08:00 SRC=131.252.116.141 DST=10.1.200.10 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=57370 DF PROTO=TCP SPT=6000 DPT=42 WINDOW=65535 RES=0x00 SYN URGP=0 Dec 13 06:41:49 gateway kernel: Web netrecall drops:IN=br0 OUT=br0 PHYSIN=eth1 PHYSOUT=eth0 SRC=131.252.116.141 DST=10.1.19.7 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=57370 DF PROTO=TCP SPT=6000 DPT=42 WINDOW=65535 RES=0x00 SYN URGP=0 Dec 13 06:41:49 gateway kernel: X12 drops:IN=br0 OUT=br0 PHYSIN=eth1 PHYSOUT=eth0 SRC=131.252.116.141 DST=10.1.20.14 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=57370 DF PROTO=TCP SPT=6000 DPT=42 WINDOW=65535 RES=0x00 SYN URGP=0 Dec 13 06:41:49 gateway kernel: Web netrecall drops:IN=br0 OUT=br0 PHYSIN=eth1 PHYSOUT=eth0 SRC=131.252.116.141 DST=10.1.19.2 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=57370 DF PROTO=TCP SPT=6000 DPT=42 WINDOW=65535 RES=0x00 SYN URGP=0 Dec 13 06:41:49 gateway kernel: Htpedi drops:IN=br0 OUT=br0 PHYSIN=eth1 PHYSOUT=eth0 SRC=131.252.116.141 DST=10.1.20.17 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=57370 DF PROTO=TCP SPT=6000 DPT=42 WINDOW=65535 RES=0x00 SYN URGP=0 Dec 13 06:41:49 gateway kernel: Edirecall drops:IN=br0 OUT=br0 PHYSIN=eth1 PHYSOUT=eth0 SRC=131.252.116.141 DST=10.1.20.12 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=57370 DF PROTO=TCP SPT=6000 DPT=42 WINDOW=65535 RES=0x00 SYN URGP=0 James Lay Network Manager/Security Officer AmeriBen Solutions/IEC Group Deo Gloria!!! _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
-- "Unix IS user-friendly. It's just picky about who its friends are." _,.-:*"``'*:-.,_,.-:*"``'*:-.,_,.-:*"``'*:-.,_,.-:*"``'*:-.,_,.-:*"``'*:-.,_ Daniel Fairchild - Chief Security Officer | danielf () supportteam net C I Host. 1851 Central Drive Suite 110. Bedford, TX 76021 T. 888.868.9931 ext 7103 F. 888.241.2294 http://www.cihost.com ------------------------------------------- Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such case, you should destroy this message and kindly notify the sender by reply email. Please advise immediately if you or your employer do not consent to Internet email for messages of this kind. Opinions, conclusions and other information in this message that do not relate to the official business of my firm shall be understood as neither given nor endorsed by it. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- TCP Port 42 port scans? What the heck over... James Lay (Dec 13)
- Re: TCP Port 42 port scans? What the heck over... Dave Aitel (Dec 13)
- RE: TCP Port 42 port scans? What the heck over... Dave Killion (Dec 13)
- RE: Cipher Tool richard capistrano (Dec 15)
- Re: RE: Cipher Tool James Tucker (Dec 18)
- Re: RE: Cipher Tool Ron DuFresne (Dec 22)
- Re: RE: Cipher Tool Willem Koenings (Dec 22)
- RE: Cipher Tool richard capistrano (Dec 15)
- Re: TCP Port 42 port scans? What the heck over... Ron (Dec 14)
- Re: TCP Port 42 port scans? What the heck over... Daniel F. Chief Security Engineer - (Dec 14)
- Re: TCP Port 42 port scans? What the heck over... Maxime Ducharme (Dec 14)
- Re: TCP Port 42 port scans? What the heck over... Matt Ostiguy (Dec 14)
- Re: TCP Port 42 port scans? What the heck over... Valdis . Kletnieks (Dec 22)
- Re: TCP Port 42 port scans? What the heck over... Matt Ostiguy (Dec 22)
- Re: TCP Port 42 port scans? What the heck over... Ron DuFresne (Dec 22)
- Re: TCP Port 42 port scans? What the heck over... Valdis . Kletnieks (Dec 22)
- Re: TCP Port 42 port scans? What the heck over... Ron DuFresne (Dec 22)
- Re: TCP Port 42 port scans? What the heck over... Dave Aitel (Dec 22)
- Re: TCP Port 42 port scans? What the heck over... Valdis . Kletnieks (Dec 22)