Re: Connections to Port 5632

[Valdis Kletnieks <Valdis.Kletnieks () VT EDU>]

On Fri, 04 Aug 2000 13:41:06 BST, Doug Winter <dwinter () BUSINESSEUROPE COM>  said:
> I've done a bit of digging and port 5632 is a pcAnywhere port, so this looks
> like someone running pcAnywhere, or an exploit for it, against this system -
> which is a bit dumb, since it's a UNIX box.

First, check and make sure that it isn't a roaming user of yours trying
to get home - he may have gotten the hostname confused, or his laptop
has an icon labeled 'telnet' or 'connect' even though it REALLY launches
pcAnywhere, or other similar bozo stunts...

Second off, I've seen some *really* dumb PC software out there - I've tried
to close off port 13 and 37 (which offer time servicdes) on the machine
that USED to be our NTP server, but one popular PC package retries the
connection immediately, over and over, even when handed an ICMP Port Unreachable.
So I have to live with 40 packets/sec of 13 and 37 traffic (yes THAT much),
because if I turn it off it jumps to 110/sec.

Blech. ;)

                                Valdis Kletnieks
                                Operating Systems Analyst
                                Virginia Tech