Full Disclosure mailing list archives
Re: Port 6881 scans - why?
From: Blue Boar <BlueBoar () thievco com>
Date: Thu, 25 Sep 2003 15:11:41 -0700
Paul Johnson wrote:
Am getting a Distributed (several diverse net blocks) and fair quantity (100 packets per min. per IP) of port 6881 hits... Any idea what this is (other than possibly BT - Snark - per google)... No I have not run / analysis with a sniffer... Currently hitting the FW...
TCP, I assume?It probably IS BitTorrent. If any of the users behind your firewall are trying to use BitTorrent, then that would cause outside people to try to hit port 6881 on your outside interface. Check for DST TCP 6881-6889 going from the inside to the outside, that would be your BT user, if that's what it is.
BB _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Probable new MS DCOM RPC worm for Windows, (continued)
- RE: Probable new MS DCOM RPC worm for Windows Derek Vadala (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows Exibar (Sep 25)
- RE: Probable new MS DCOM RPC worm for Windows Derek Vadala (Sep 25)
- RE: RE: Probable new MS DCOM RPC worm for Windows Robert Ahnemann (Sep 25)
- RE: Probable new MS DCOM RPC worm for Windows Williams Jon (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows Paul Farrow (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows Jordan Wiens (Sep 25)
- SV: RE: Probable new MS DCOM RPC worm for Windows Peter Kruse (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows Paul Farrow (Sep 25)
- RE: RE: Probable new MS DCOM RPC worm for Windows Schmehl, Paul L (Sep 25)
- RE: Probable new MS DCOM RPC worm for Windows Brian (Sep 25)
- Port 6881 scans - why? Paul Johnson (Sep 25)
- Re: Port 6881 scans - why? Blue Boar (Sep 25)
- Port 6881 scans - why? Paul Johnson (Sep 25)
- RE: Probable new MS DCOM RPC worm for Windows Carey, Steve T GARRISON (Sep 25)
- Re: RE: Probable new MS DCOM RPC worm for Windows lists (Sep 27)
- Re: RE: Probable new MS DCOM RPC worm for Windows Paul Schmehl (Sep 27)
- Re: RE: Probable new MS DCOM RPC worm for Windows Karl DeBisschop (Sep 27)
- Re: RE: Probable new MS DCOM RPC worm for Windows Paul Schmehl (Sep 27)
- Re: RE: Probable new MS DCOM RPC worm for Windows Karl DeBisschop (Sep 27)