Unknown port traffic....

[Clifford Durbin <CDurbin () toddpacific com>]

Can anybody give me some insight what the heck is using port 1120 and 1900?
> From what I've read 1900 is UPnP on XP and ME but my machine
(xxx.xxx.xxx.165) is a 2K server and the recipient address (xxx.xxx.xxx.161)
is a Cisco router. Looking through the Internet Asignment Authority port
assignments page (http://www.iana.org/assignments/port-numbers) it lists
port 1900 as SSDP (Simple Service Discovery Protocol) and 1120 isn't even
listed. I get these approximately every 30 seconds.

[**] ICMP Destination Unreachable (Port Unreachable) [**]
09/26-10:11:28.577837 xxx.xxx.xxx.161 -> xxx.xxx.xxx.165
ICMP TTL:255 TOS:0xC0 ID:60478 IpLen:20 DgmLen:56
Type:3  Code:3  DESTINATION UNREACHABLE: PORT UNREACHABLE
** ORIGINAL DATAGRAM DUMP:
xxx.xxx.xxx.165:1120 -> xxx.xxx.xxx.161:1900
UDP TTL:127 TOS:0x0 ID:23456 IpLen:20 DgmLen:160
Len: 140
** END OF DUMP
00 00 00 00 45 00 00 A0 5B A0 00 00 7F 11 EF 32  ....E...[......2
CF 99 A8 A5 CF 99 A8 A1 04 60 07 6C 00 8C 9D E2  .........`.l....

Clifford Durbin
Sr. Systems Administrator
Todd Pacific Shipyards
Phone : 206-623-1635 x234
Fax : 206-442-8506
Email : cdurbin () toddpacific com <mailto:cdurbin () toddpacific com>




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users