RE: Port 3335

[Danny <Danny () drexel edu>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Eliftps default port is 3335 
http://software.sci.utah.edu/eliftp.html 

Can you give us any more information? Is the traffic being sent to your hosts with a destination port or source port of 
3335, is it TCP or UDP?
Any chance of getting some packet dumps of this activity?

Cheers
Danny
Network Security Engineer
Drexel University
PGP Print: C6AD B205 E3C6 38AB 0164 6604 66F5 CCFC F4ED F1E0
PGP Key: http://akasha.irt.drexel.edu/danny.asc
 

|->-----Original Message-----
|->From: Robin Lynn Frank [mailto:rlfrank () paradigm-omega com]
|->Sent: Friday, March 07, 2003 8:54 PM
|->To: incidents () securityfocus com
|->Subject: Port 3335
|->
|->I am seeing a lot of activity on port 3335 from a number of domains.  Can
|->someone give me an idea as to what this may be about?
|->--
|->Sed quis custodiet ipsos custodes?
|->=========================================================================
|->=
|->Robin Lynn Frank - Director of Operations - Paradigm-Omega, LLC
|->Copyright and PGP/GPG info in mail or message headers.
|->Email acceptance policy at http://paradigm-omega.com/email_policy.html
|->=========================================================================
|->=
|->
|->-------------------------------------------------------------------------
|->---
|->
|-><Pre>Lose another weekend managing your IDS?
|->Take back your personal time.
|->15-day free trial of StillSecure Border Guard.</Pre>
|-><A href="http://www.securityfocus.com/stillsecure";>
|->http://www.securityfocus.com/stillsecure </A>


-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBPmzPLGb1zPz07fHgEQJrEACgoZNGh2fRYcK40t2TbqaBpYWN6KAAniY5
MR7KAj7Wni2l4Lhdalfvhx21
=EV6j
-----END PGP SIGNATURE-----

----------------------------------------------------------------------------

<Pre>Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.</Pre>
<A href="http://www.securityfocus.com/stillsecure";> http://www.securityfocus.com/stillsecure </A>