Security Incidents mailing list archives

Re: UDP port 1345 (VPJP ??)


From: Mike Meredith <mike.meredith () PORT AC UK>
Date: Mon, 20 Nov 2000 10:52:16 +0000

-----BEGIN PGP SIGNED MESSAGE-----

Hi

On Thu, 16 Nov 2000, Peter Freeman wrote:
ngctw32.exe was installed with Norton Ghost, the
properties of the exe describe it as Norton Gost Client
Agent. If anyone can tell me what it was reporting to
ip 229.55.150.208 and why, it would be nice.

That IP is a multicast netblock. In fact a traceroute from my
workstation doesn't reach anywhere.

I've spoken to our Ghost expert; although he isn't clear on the issue,
he thinks the packet is a message along the lines of "I'm interested in
hearing about image called FRED".
- --
mike.meredith () port ac uk                http://www.iso.port.ac.uk/~mike
Senior Informatics Officer (Postmaster, Hostmaster, and security)

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQCVAwUBOhkD4c19DFC51SfFAQE0zgQAjfbe32phcGdf+k4zxF52oixb5lfVNQ3k
Jzw+UROdkp9ft3G0VjDYUFAHya3Ux5aeMfc+QQ6u8lG3muvLBmtsa5n49NGz3t5n
rcybmu76MMmyNRRDjOaTJBvE+TlZoaRYTBn0kVo99yn5bgc8tZbevqmHFEntApRZ
8Mf0R+077vs=
=U9XH
-----END PGP SIGNATURE-----


Current thread: