Re: Catalyst 4500 listening on TCP 6154 on all interfaces

["Curtis, Bruce" <bruce.curtis () ndsu edu>]

On May 7, 2018, at 2:58 PM, Jay Farrell via NANOG <nanog () nanog org<mailto:nanog () nanog org>> wrote:

I saw that list, but understood the numbers there to be IDS signature
numbers, rather than port numbers. Am I misreading something?

  No, you are correct.

As Niels Bakker pointed out that is a list of IDS signatures, not a list of ports that Cisco devices listen on.

I just skimmed the pages, I should have read them more thoroughly before sending to the list.



On Mon, May 7, 2018 at 12:24 PM, Curtis, Bruce <bruce.curtis () ndsu edu<mailto:bruce.curtis () ndsu edu>>
wrote:

Some Cisco devices use 6154 for ypxfrd.


6154 ypxfrd Portmap Request (Info, Atomic*)

Triggers when a request is made to the portmapper for the YP transfer
daemon (ypxfrd) port.

https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/
configuration/guide/fsecur_c/scfids.html

https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/
configuration/guide/asa_84_cli_config/protect_tools.html



---
Bruce Curtis                         bruce.curtis () ndsu edu<mailto:bruce.curtis () ndsu edu>
Certified NetAnalyst II                701-231-8527
North Dakota State University