Re: Port probes: 1680 UDP, 9393 TCP, and 4000 TCP

From: Phil Dyer (dyerat_private)
Date: Mon Jun 18 2001 - 13:30:30 PDT

Next message: Gregory McCann: "RE: 2300 FTP accesses from Korea"

Previous message: Derek Kwan: "Re: 2300 FTP accesses from Korea"
In reply to: Paul Gear: "Port probes: 1680 UDP, 9393 TCP, and 4000 TCP"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Mon, 18 Jun 2001, Paul Gear wrote:

> 1.  1680 UDP
>
> ... kernel: Packet log: input DENY ppp0 PROTO=17 xxx.xxx.xxx.xxx:1680
> xxx.xxx.xxx.xxx:1680 L=90 S=0x00 I=47873 F=0x0000 T=127 (#84)
>
> What is port 1680?  I can't seem to find any information on it anywhere
> on the web.  I've only seen this one packet, and it was from the IP
> address adjacent to mine on the dialup bank.

UDP 1680 is Microcom's Carbon Copy. I get it from time to time from
other Earthlink users in my IP range.

They probably have a static IP set to connect to, and it is changing when
disconnected.

-- 
=-=-=-=-=--=-=--=-=-=-=
Phil Dyer
dyerat_private
=-=-=-=-=--=-=--=-=-=-=

Next message: Gregory McCann: "RE: 2300 FTP accesses from Korea"
Previous message: Derek Kwan: "Re: 2300 FTP accesses from Korea"
In reply to: Paul Gear: "Port probes: 1680 UDP, 9393 TCP, and 4000 TCP"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Jun 18 2001 - 20:05:09 PDT