RE: Port 3335

From: Danny (Dannyat_private)
Date: Mon Mar 10 2003 - 09:41:49 PST

  • Next message: Jeff Kell: "Re: Real-world attacks on sendmail CA-2003-07 seen"

     
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    Eliftps default port is 3335 
    http://software.sci.utah.edu/eliftp.html 
    
    Can you give us any more information? Is the traffic being sent to your hosts with a destination port or source port of 3335, is it TCP or UDP?
    Any chance of getting some packet dumps of this activity?
    
    Cheers
    Danny
    Network Security Engineer
    Drexel University
    PGP Print: C6AD B205 E3C6 38AB 0164 6604 66F5 CCFC F4ED F1E0
    PGP Key: http://akasha.irt.drexel.edu/danny.asc
     
    
    |->-----Original Message-----
    |->From: Robin Lynn Frank [mailto:rlfrank@paradigm-omega.com]
    |->Sent: Friday, March 07, 2003 8:54 PM
    |->To: incidentsat_private
    |->Subject: Port 3335
    |->
    |->I am seeing a lot of activity on port 3335 from a number of domains.  Can
    |->someone give me an idea as to what this may be about?
    |->--
    |->Sed quis custodiet ipsos custodes?
    |->=========================================================================
    |->=
    |->Robin Lynn Frank - Director of Operations - Paradigm-Omega, LLC
    |->Copyright and PGP/GPG info in mail or message headers.
    |->Email acceptance policy at http://paradigm-omega.com/email_policy.html
    |->=========================================================================
    |->=
    |->
    |->-------------------------------------------------------------------------
    |->---
    |->
    |-><Pre>Lose another weekend managing your IDS?
    |->Take back your personal time.
    |->15-day free trial of StillSecure Border Guard.</Pre>
    |-><A href="http://www.securityfocus.com/stillsecure">
    |->http://www.securityfocus.com/stillsecure </A>
    
    
    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.0
    
    iQA/AwUBPmzPLGb1zPz07fHgEQJrEACgoZNGh2fRYcK40t2TbqaBpYWN6KAAniY5
    MR7KAj7Wni2l4Lhdalfvhx21
    =EV6j
    -----END PGP SIGNATURE-----
    
    ----------------------------------------------------------------------------
    
    <Pre>Lose another weekend managing your IDS?
    Take back your personal time.
    15-day free trial of StillSecure Border Guard.</Pre>
    <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
    



    This archive was generated by hypermail 2b30 : Mon Mar 10 2003 - 10:15:31 PST