From owner-freebsd-security Sun Aug 9 12:09:18 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id MAA12138 for freebsd-security-outgoing; Sun, 9 Aug 1998 12:09:18 -0700 (PDT) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from verdi.nethelp.no (verdi.nethelp.no [158.36.41.162]) by hub.freebsd.org (8.8.8/8.8.8) with SMTP id MAA12133 for ; Sun, 9 Aug 1998 12:09:15 -0700 (PDT) (envelope-from sthaug@nethelp.no) From: sthaug@nethelp.no Received: (qmail 12624 invoked by uid 1001); 9 Aug 1998 19:08:55 +0000 (GMT) To: jdn@acp.qiv.com Cc: freebsd-security@FreeBSD.ORG Subject: Re: What are these connect attempts? In-Reply-To: Your message of "Sun, 9 Aug 1998 14:01:33 -0500 (CDT)" References: X-Mailer: Mew version 1.05+ on Emacs 19.34.2 Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Date: Sun, 09 Aug 1998 21:08:55 +0200 Message-ID: <12622.902689735@verdi.nethelp.no> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > >traceroute. > > Did that. I guess I was a bit terse. What *you* are seeing is somebody running traceroute against your machine. > Except for the 195.8.97.66, which is ns5.isi.net, they all > seen to come from shortcut.???.isi.net. They all trace back to a > running machine. What are they looking for and what do they expect to > find at those high port numbers? That's precisely the point - they *don't* expect to find anything at those high port numbers on your machine. The high port numbers are used to minimize the probability that traceroute will collide with a running application. traceroute normally starts at port (32768 + 666) and runs up from there. Steinar Haug, Nethelp consulting, sthaug@nethelp.no To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message