Security Incidents mailing list archives

Re: Port 4

From: drow () FALSE ORG (Daniel Jacobowitz)
Date: Tue, 11 Jan 2000 20:07:14 -0500


The last port 4 I saw open was a variant on bindshell, I don't recall
exactly which variant.  It's not an ok thing to have running.

On Tue, Jan 11, 2000 at 09:10:13PM +0500, CyberPsychotic wrote:

On Sun, 9 Jan 2000 out of nowhere Arne Vidar Sj?n?st spoke:

~ :I have noticed a few servers (included mine) lately with port 4 open.
~ :somone know what this port is for? I have never had
~ :any connections on the port.
~ :

 that's quite unsual. Your servers are unix I assume. Try lsof/fuser and
see  what processes bound it. Then you can go further..


Dan

/--------------------------------\  /--------------------------------\
|       Daniel Jacobowitz        |__|        SCS Class of 2002       |
|   Debian GNU/Linux Developer    __    Carnegie Mellon University   |
|         dan () debian org         |  |       dmj+ () andrew cmu edu      |
\--------------------------------/  \--------------------------------/

Current thread:

Re: strange entrys in /var/log/messages, (continued)
- - - Re: strange entrys in /var/log/messages Robert Graham (Jan 12)
    - Re: Maillog Suspicious Jose Nazario (Jan 11)
    - Re: Maillog Suspicious Larry W. Cashdollar (Jan 11)
    - Attempted port scans. Steve (Jan 11)
    - Re: Maillog Suspicious Khetan Gajjar (Jan 11)
    - Text file monitor? Luther Trammel (Jan 12)
    - Re: Text file monitor? James A Kennemore Jr (Jan 12)
    - Re: Maillog Suspicious Christopher Rhodes (Jan 12)
    - Re: Maillog Suspicious Christopher Rhodes (Jan 12)
  - Re: Port 4 CyberPsychotic (Jan 11)
    - Re: Port 4 Daniel Jacobowitz (Jan 11)