Re: Strange UDP Activity

From: Eric Brandwine (ericbat_private)
Date: Tue Apr 16 2002 - 13:12:09 PDT

  • Next message: Michal Zalewski: "Re: HTTP CONNECT attempts"

    >>>>> "jn" == Jose Nazario <joseat_private> writes:
    
    jn> On Tue, 16 Apr 2002, Steve Vawter wrote:
    >> Where did you find SMTP?  SMTP lives on port 25/tcp.  Unless some
    >> sites run it in strange places for "security" through obscurity
    >> reasons.
    
    jn> he said 'snmp', which sits on 167/udp. he also saaw 1067/udp. a typo,
    jn> perhaps, given the recent spate of snmp problems.
    
    Um...
    
    ericb@marvin:~> grep snmp /etc/services 
    snmp            161/udp                         # Simple Net Mgmt Proto
    snmp-trap       162/udp         snmptrap        # Traps for SNMP
    ericb@marvin:~> grep 167 /etc/services
    zsh: 5095 exit 1     grep 167 /etc/services
    
    Yes, you can configure your SNMP agents to use whatever numeric port
    you want, but SNMP is virtually always 161/udp.
    
    ericb
    -- 
    Eric Brandwine     |  When you choose between the lesser of two evils, you
    UUNetwork Security |  soon forget that you choose evil.
    ericbat_private       |
    +1 703 886 6038    |      - Ammon Hennacy
    Key fingerprint = 3A39 2C2F D5A0 FC7C  5F60 4118 A84A BD5D  59D7 4E3E
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Apr 16 2002 - 14:59:25 PDT