Re: Port 6112

[bugtraq () NETWORKICE COM (Robert Graham)]

The game Diablo running on BattleNet servers will use this port.
http://www.battle.net/support/faq/mac.shtml

Are you seeing such things as "scans" or just a bunch of connection
attempts? Remember that if you dialup the Internet, you will likely get
"scanned" the moment you logon. What is really happening is that your have
inheritted the IP address of somebody else who was playing a game or
chatting. Some products are very agressively at trying to reestablish the
connection, so you may be getting TCP connection requests or UDP packets
even 20 minutes later.

There are LOTs of these applications out there; so if you see the same
request over and over soon after dialing up, this is amost certainly the
cause. On the other hand, some hackers do "camp" on dialup ranges, waiting
for somebody to dialup that has the particular vulnerability they are
looking for.

Robert Graham

-----Original Message-----
From: Incidents Mailing List [mailto:INCIDENTS () securityfocus com]On
Behalf Of Stuart Staniford-Chen
Sent: Friday, March 17, 2000 3:08 AM
To: INCIDENTS () securityfocus com
Subject: Port 6112

I have recently seen several scans on port 6112 (both TCP and UDP).  I
can't find any information on this port on several lists of ports and
their uses.  Anyone know what might use this port?

Thanks,

Stuart.

P.S.  It doesn't seem to me that there's a way to search the archive for
the incidents mailing list.  Did I miss it?  That would be a really nice
feature at www.securityfocus.com

--
Stuart Staniford-Chen --- President --- Silicon Defense
                   stuart () silicondefense com
(707) 822-4588                     (707) 826-7571 (FAX)