Re: Strange behaviour

[bejtlich () TEXAS NET (Richard Bejtlich)]

Hi Anthony,

Poking around the web, I found out port 2766 is typically part of an sscan,
as reported by CERT, here:

http://www.cert.org/incident_notes/IN-99-01.html

That doc reports port 2766 tcp is "Solaris listen/nlps_server."

Digging further it seems that port was used by Solaris 
to listen for incoming print jobs.  Refs:

http://wugate.wustl.edu/~rachelle/printfaq2.html
http://ume.med.ucalgary.ca/usenet/Solaris/0047.html

As to the vulnerability, I'm not sure.

Richard

-----
I've seen two different attempts. all in the last 2 days, of tcp
connection attempts to port 2766.

Regards,
Anthony Kehoe