From owner-freebsd-questions  Tue Nov 24 18:16:47 1998
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id SAA12298
          for freebsd-questions-outgoing; Tue, 24 Nov 1998 18:16:47 -0800 (PST)
          (envelope-from owner-freebsd-questions@FreeBSD.ORG)
Received: from firewall.scitec.com.au (fgate.scitec.com.au [203.17.180.68])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id SAA12273
          for <freebsd-questions@FreeBSD.ORG>; Tue, 24 Nov 1998 18:16:27 -0800 (PST)
          (envelope-from john.saunders@scitec.com.au)
Received: by firewall.scitec.com.au; id NAA17328; Wed, 25 Nov 1998 13:16:18 +1100 (EST)
Received: from mailhub.scitec.com.au(203.17.180.131) by fgate.scitec.com.au via smap (3.2)
	id xma017322; Wed, 25 Nov 98 13:15:51 +1100
Received: from saruman (saruman.scitec.com.au [203.17.182.108]) by mailhub.scitec.com.au (8.6.12/8.6.9) with SMTP id NAA01707; Wed, 25 Nov 1998 13:15:50 +1100
From: "John Saunders" <john.saunders@scitec.com.au>
To: "Stephen C. Comoletti" <stevec@delanet.com>,
        <freebsd-questions@FreeBSD.ORG>
Subject: RE: udp port 31337
Date: Wed, 25 Nov 1998 13:15:50 +1100
Message-ID: <005c01be1819$85672110$6cb611cb@saruman.scitec.com.au>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0
In-Reply-To: <365AD7D7.AD76E051@delanet.com>
X-Mimeole: Produced By Microsoft MimeOLE V4.72.2106.4
Importance: Normal
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

> Just curious, what is udp port 31337 for? It's not in my /etc/services at
all
> and I got someone steadily pounding away at it on my new 3.0 box.
> They have not gotten in or done any damage, just spammed my logs is all.

Also keep an eye out for TCP ports 12345 and 12346. These are
for another Win95 Trojan program.

When you get packets destined to these ports the source IP
address is valid. This is because these guys expect some
response back. So track down who owns the IP address and
report it as cracking activity.

Cheers.
--   .   +-------------------------------------------------------+
 ,--_|\  | John Saunders    mailto:John.Saunders@scitec.com.au   |
/  Oz  \ | SCITEC LIMITED   Phone +61294289563  Fax +61294289933 |
\_,--\_/ | "By the time you make ends meet, they move the ends." |
      v  +-------------------------------------------------------+


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message