Re: port 17027

["Frank L. Heidt" <heidtf () psns navy mil>]

Ken et. al.

What you have going on here is *likely* to be a new-ish version of pkzip (or some such freeware) calling' home to mama 
to get a popup banner to display  during the execution of the app.  This is pretty much a method of realizing some 
revenue on
"free" software.    I assume the boxes generating the traffic are running NT.  Check out this link :  
http://www.pkware.com/sponsors.html for a more complete explanation.  As one would expect, Robert Graham has a link 
describing this behavior on
his fire wall FAQ ;-)  http://www.robertgraham.com/pubs/firewall-seen.html


Ken Fox wrote:

> Has anyone seen heavy activity on port 17027 from boxes inside a firewall -- specifically, a number of users systems 
> keep trying to send tcp packets to ip addresses in the 216.33.0.0 through 216.35.0.0 range with a desitination port 
> of 17027.
>
> That address range is owned by exodus.net , and further the individuals IP addresses are owned by
> In the cases where we have contacted the owners of the systems sending these packets, they have been clearly clueless 
> about the traffic emanating from thier computers.
>
> HAs anyone else seen this?
>
> Thanks, Ken

--
Frank L. Heidt  (Heidtf () psns navy mil) Office: (360) 476-3735
Alpha Geek (Puget Sound Naval Shipyard Project)
SRA Inc. Western Ops.