Re: Strange set of TCP ports

[Josh Tolley <josh () raintreeinc com>]

If it's a windows box, you might take a tool like psexec.exe, 
BeyondExec.exe (not sure from where... Google should do it), or the 
equivalent whose name I've forgotten from the corresponding Windows 
resource kit and use it to run FPort or a similar utility. It worked for 
me recently while investigating other strange traffic.

Josh Tolley

mgotts () 2roads com wrote:

> > Run openports.exe from DiamondCS on the suspect boxen.
> > If you don't have physical access, but do have admin
> > access, use psexec.exe from SysInternals, as well.
>
>
> psexec.exe from SysInternals is a remote program execution utility. I use 
> it now and then, and am not aware of any capability to have it list ports 
> in use and what programs are using them.
>
> SysInternals probably does have such a utility, but I'm not sure what it 
> is off the top of my head.
>
> -- Mark
>
>
> > --- Raistlin <raistlin () gioco net> wrote:
> >
> > > Greetings,
> > >
> > > can someone help me in identifying the following
> > > strange subset of open 
> > > TCP ports ?
> > > 3687/tcp open  unknown
> > > 3688/tcp open  unknown
> > > 3689/tcp open  rendezvous
> > > 3690/tcp open  unknown
> > > 3691/tcp open  unknown
> > >
> > > Googling or looking at the usual known ports lists
> > > do not yield any 
> > > results. I'd like to identify this beast if
> > > possible. Thanks in advance.
> > >
> > > Stefano
> ---------------------------------------------------------------------------
>
> ----------------------------------------------------------------------------
>
> >
> ---------------------------------------------------------------------------
>
> ----------------------------------------------------------------------------
>
>
> > ForwardSourceID:NT000844F2 
>
>
> ---------------------------------------------------------------------------
> ----------------------------------------------------------------------------

--
Josh Tolley
Raintree Systems, Inc.
http://www.raintreeinc.com
760 509 9000

---------------------------------------------------------------------------
----------------------------------------------------------------------------