Re: Weird scan on port 1214

[Matt Scarborough <vexversa () usa net>]

On Thu, 28 Jun 2001 22:17:54 +0300 (EET DST), Vangelis Haniotakis wrote:

> Now, port 1214 is reserved for what is called  "Intelligent
> Communications Protocol" on tcp and KAZAA on udp. I don't know what the
> first one is, I do know that Kazaa is a file sharing thingy though.

KaZaA's associated WinAmp file sharing plug-in is a Napster/Gnutella-like p2p
application.
 
http://www.kazaa.com/index.php?page=help
http://www.kazaa.com/kwp/help.htm

KaZaA will
-open local port 1214 for outbound requests to remote port 80 to find the
distributed network
-send requests to remote port 1214 after a file search determines a kewl MP3
been found
-accept requests on local port 1214 to stream MP3s to other clients

If that fits your pattern, look for \...\Winamp\Plugins\gen_kazaa.dll

Matt Scarborough 2001-06-30



____________________________________________________________________
Get free email and a permanent address at http://www.amexmail.com/?A=1


----------------------------------------------------------------------------


This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see:

http://aris.securityfocus.com