Re: IRC ports open on NT4?

[Jan P Tietze <jptietze () netheads de>]

"Philip J. Koenig" wrote:

> Have some suspicious stuff going on at a site and in my initial
> investigation I went to an NT server there and typed 'netstat -an' to
> see what was open, and found these curious entries:
>
> TCP     0.0.0.0:6666            0.0.0.0:0                       LISTENING
> TCP     0.0.0.0:6667            0.0.0.0:0                       LISTENING

> [...]
> TCP     127.0.0.1:6667          127.0.0.1:1043          ESTABLISHED
> TCP     127.0.0.1:6666          127.0.0.1:1043          ESTABLISHED

The machine has PowerChute running and is attached to an APC UPS, right? Try
stopping the PowerChute service and see these listeners (probably) disappear...

Regards

Jan

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards