Re: in-house ports list

[Clyde Hoadley <hoadleyc () MSCD EDU>]

Barros, Jacob wrote:
> Does anyone have an in-house ports list that you've been developing?
> For instance, I've noticed that TCP 20480 is always associated with
> random hostnames but it always ends with blue.aol.com.  I'm going to
> start developing one but it would be nice if someone had something
> similar.  Anyone?

I'm not sure if this is what your referring to or not.
I keep these links booked marked for quick reference
while researching odd ports etc...

The Internet Ports Database
http://www.portsdb.org/bin/portsdb.cgi

SANS: Odd port numbers and Trojan ports
http://www.sans.org/resources/idfaq/oddports.php

Firewall Forensics (What am I seeing?)
http://www.robertgraham.com/pubs/firewall-seen.html

www.doshelp.com (trojan list)
http://www.doshelp.com/trojanports.htm

www.simovits.com (trojan list)
http://www.simovits.com/nyheter9902.html

--
Clyde Hoadley, CISSP
Security & Disaster Recovery Coordinator
Department of Information Technology
Metropolitan State College of Denver
hoadleyc () mscd edu
http://clem.mscd.edu/~hoadleyc/
(303) 556-5074

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.