Security Incidents mailing list archives

Re: Port 27960

From: oddbec () ONLINE NO (Odd Arne Beck)
Date: Mon, 20 Mar 2000 20:46:01 +0100

I believe that this port is widely used for the Quake/Quake2/Quake3 gameseries..
The standard for Quake( Quake2 only?) is 27910, But I have noticed that there are a lot of gameservers that run 
different types of quake2-servers, and they in turn listen to the different ports ranging from 27910 -> 28000

:-)

----- Original Message ----- 
From: Stuart Staniford-Chen <stuart () SILICONDEFENSE COM>
To: <INCIDENTS () SECURITYFOCUS COM>
Sent: Friday, March 17, 2000 2:18 PM
Subject: Port 27960

I'm guessing this is another Internet game port.  Anyone know for sure?

Here's a sample piece of a scan detect.

Stuart.

Mar 13 18:50:33 xxx.xxx.xxx.xxx:1510 -> 208.25.112.20:53 UDP
Mar 13 18:50:33 xxx.xxx.xxx.xxx:27960 -> 192.246.40.56:27950 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 24.28.21.205:27960 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 206.191.192.47:27960 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 207.127.210.34:27960 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 212.140.216.69:37963 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 212.140.216.69:37961 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 206.136.149.10:27960 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 207.238.206.13:27965 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 207.105.234.8:27960 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 210.97.228.42:27961 UDP
Mar 13 18:50:35 xxx.xxx.xxx.xxx:27960 -> 210.97.228.42:27963 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 216.202.141.69:27960 UDP
Mar 13 18:50:35 xxx.xxx.xxx.xxx:27960 -> 216.202.141.69:27963 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 195.250.175.164:27960 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 209.30.137.20:27960 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 200.27.132.9:26000 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 212.93.4.18:27962 UDP
Mar 13 18:50:34 xxx.xxx.xxx.xxx:27960 -> 216.46.240.6:27962 UDP

--
Stuart Staniford-Chen --- President --- Silicon Defense
                   stuart () silicondefense com
(707) 822-4588                     (707) 826-7571 (FAX)

Current thread:

Re: lots of interest in port 109 (POP2), (continued)
- - Re: lots of interest in port 109 (POP2) Paul Rice (Mar 13)
  - Munged Napster Sessions Stephen P. Berry (Mar 13)
    - Looking for Squid Proxies Cy Schubert - ITSD Open Systems Group (Mar 16)
    - Re: Munged Napster Sessions Vanja Hrustic (Mar 16)
    - Port 6112 Stuart Staniford-Chen (Mar 17)
    - Re: Port 6112 Robert Graham (Mar 20)
    - Re: Port 6112 Stuart Staniford-Chen (Mar 20)
    - nbname scans Rick Tortorella (Mar 20)
    - Port 27960 Stuart Staniford-Chen (Mar 17)
    - Re: Port 27960 steve balla (Mar 20)
    - Re: Port 27960 Odd Arne Beck (Mar 20)
    - Re: Port 27960 David Groves (Mar 21)
    - Re: Port 27960 Sean Birkholz (Mar 25)
    - Followup Analysis of a Shaft DDoS Node and Master Richard Wash (Mar 28)
    - Re: Port 27960 steve balla (Mar 28)
    - Re: Port 27960 TJ Jablonowski (Mar 28)
    - Re: Munged Napster Sessions simond () IRRELEVANT ORG (Mar 17)
    - Re: Munged Napster Sessions Stuart Staniford-Chen (Mar 20)
    - Re: Munged Napster Sessions Murray, Mike (Mar 20)