RE: Why alerts on ports 1025-1029, 1036

From: Erik Boles (erikat_private)
Date: Mon Mar 31 2003 - 16:28:52 PST

  • Next message: ePAc: "Re: [CERT] Why alerts on ports 1025-1029, 1036"

    Tomas,
    
    1025 is dynamically assigned, so really any program can request use of it. I
    have seen nterm use 1026 rather frequently.  1036 is usually an outbound
    port.
    
    You can see what all is listneing on your system by running netstat -l
    (unix) or netstat -a (windows) from a command prompt.
    
    Erik
    
    
    
    -----Original Message-----
    From: Tomas Carlsson [mailto:xtcat_private]
    Sent: Monday, March 31, 2003 3:04 PM
    To: incidentsat_private
    Subject: Why alerts on ports 1025-1029, 1036
    
    
    I get constant alerts from Zonealarm and it is always blocking on
    ports 1025, 1026, 1027 or 1029.
    Can someone tell me why?
    
    Sometimes also alerts from blocking on port 1036. What's there?
    
    TIA
    Tomas
    
    
    
    ----------------------------------------------------------------------------
    Powerful Anti-Spam Management and More...
    SurfControl E-mail Filter puts the brakes on spam,
    viruses and malicious code. Safeguard your business
    critical communications. Download a free 30-day trial:
    http://www.securityfocus.com/SurfControl-incidents
    
    
    ----------------------------------------------------------------------------
    Powerful Anti-Spam Management and More...
    SurfControl E-mail Filter puts the brakes on spam,
    viruses and malicious code. Safeguard your business
    critical communications. Download a free 30-day trial:
    http://www.securityfocus.com/SurfControl-incidents
    



    This archive was generated by hypermail 2b30 : Mon Mar 31 2003 - 17:06:40 PST