Connections to Port 5632

[Doug Winter <dwinter () BUSINESSEUROPE COM>]

For the last few days we have seen a large number of connections (7409 at
last count) to port 5632 of one of our systems.  These have all been dropped
by our firewall.  All connections have the same source address, and this
address has not connected to any other ports.  The attempts ran continuously
for 48 hours.

I've done a bit of digging and port 5632 is a pcAnywhere port, so this looks
like someone running pcAnywhere, or an exploit for it, against this system -
which is a bit dumb, since it's a UNIX box.

This all looks a bit weird to me, which makes me think there might be
another explanation.

Has anyone got any ideas what else it might be?

Cheers,

Doug Winter
Chief Technology Officer

T: +44 (0)20 7961 0341
M: +44 (0)7879 423 002
E: dwinter () businesseurope com
3 Waterhouse Square, Holborn Bars, 142 Holborn, London EC1N 2NX