Re: IRC ports open on NT4?

["Philip J. Koenig" <pjklist () ekahuna com>]

On 15 Jul 2001, at 15:34, Jan P Tietze boldly uttered: 

> "Philip J. Koenig" wrote:
>
> > Have some suspicious stuff going on at a site and in my initial
> > investigation I went to an NT server there and typed 'netstat -an' to
> > see what was open, and found these curious entries:
> >
> > TCP     0.0.0.0:6666            0.0.0.0:0                       LISTENING
> > TCP     0.0.0.0:6667            0.0.0.0:0                       LISTENING
>
> > [...]
> > TCP     127.0.0.1:6667          127.0.0.1:1043          ESTABLISHED
> > TCP     127.0.0.1:6666          127.0.0.1:1043          ESTABLISHED
>
> The machine has PowerChute running and is attached to an APC UPS, right? Try
> stopping the PowerChute service and see these listeners (probably) disappear...
>
> Regards
>
> Jan
 

Thanks to Jan and Andrew -- you are both correct.  I assume that's it 
and will verify it a little later.

Why on earth APC would pick such longstanding known ports for their 
product is of course another issue.  At least I think I have the 
answer now.

Cheers,


Phil



--
Philip J. Koenig                                       pjklist () ekahuna com
Electric Kahuna Systems -- Computers & Communications for the New Millenium

_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://www.nfr.com/mailman/listinfo/firewall-wizards