Re: Odd traffic on port 7002 need help figuring it out.

From: nito (nitoat_private)
Date: Thu Jun 13 2002 - 15:21:08 PDT

  • Next message: wolfgangat_private: "Re: [logs] nimda web server logs"

    On Wednesday 12 June 2002 23:18, steveg wrote:
    
    > 20:33:07.209934 > myfirewallbox.63425 > 63.251.143.213.7002: S
    
    You might see traffic to/from 63.251.143.213.7002 if you're playing 
    multiplayer Half-Life or its derivatives.
    
    
    %dig half-life.central.won.net
    
    half-life.central.won.net. 3600 IN      CNAME   junee.boston.sierra.com.
    junee.boston.sierra.com. 86400  IN      A       63.251.143.213
    
    
    This hostname:port is listed in the half-life file, woncomm.lst:
    
    
    // Server Lists
    //
    Titan
    {
     half-life.east.won.net:6003
     half-life.west.won.net:6003
     half-life.central.won.net:6003
    }
    
    Auth
    {
     half-life.east.won.net:7002 
     half-life.west.won.net:7002
     half-life.central.won.net:7002
    }
    
    Master
    {
     half-life.east.won.net:27010 
     half-life.west.won.net:27010
     half-life.central.won.net:27010 
    }
    
    ModServer
    {
     half-life.east.won.net:27011
     half-life.west.won.net:27011
     half-life.central.won.net:27011
    }
    
    Regards,
    
       nito
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Jun 13 2002 - 21:59:08 PDT