Re: UDP 22 & 5632

[John Hall <johlex () home com>]

These are the ports that PCAnywhere uses. It is either someone
scanning or, more probably, a host running PCAW looking for similarly
configured hosts to connect with.

John Hall.




Aaron Turner wrote:
> I'm seeing a reoccuring pattern where a system will sequentially scan a
> network over and over and over (sometimes for hours) trying to connect to
> UDP 22 & 5632.  The source port is pretty static, always near (but higher
> than) 1024.
>
> Anyone with an idea of what this is?  It seems to be running on a Windows
> (most likely NT since the IP is in a co-lo) system.
>
> --
> Aaron Turner        aturner () vicinity com  650.237.0300 x252
> Security Engineer                         Vicinity Corp.
> Cell: 408-314-9874                        http://www.vicinity.com