From owner-freebsd-security  Sun Aug  9 13:37:51 1998
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id NAA21178
          for freebsd-security-outgoing; Sun, 9 Aug 1998 13:37:51 -0700 (PDT)
          (envelope-from owner-freebsd-security@FreeBSD.ORG)
Received: from Mercury.unix.acs.cc.unt.edu (mercury.acs.unt.edu [129.120.220.1])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA21172
          for <freebsd-security@freebsd.org>; Sun, 9 Aug 1998 13:37:49 -0700 (PDT)
          (envelope-from john@unt.edu)
Received: from leonardo.cascss.unt.edu (leonardo.cascss.unt.edu [129.120.32.203])
	by Mercury.unix.acs.cc.unt.edu (8.8.8/8.8.8) with ESMTP id PAA29221
	for <freebsd-security@freebsd.org>; Sun, 9 Aug 1998 15:37:29 -0500 (CDT)
Received: (from john@localhost) by leonardo.cascss.unt.edu (8.8.8/8.6.9) id PAA05938 for freebsd-security@freebsd.org; Sun, 9 Aug 1998 15:35:42 -0500 (CDT)
From: john <john@unt.edu>
Message-Id: <199808092035.PAA05938@leonardo.cascss.unt.edu>
Subject: Re: What are these connect attempts?
In-Reply-To: <Pine.BSF.3.96.980809141555.1348A-100000@acp.qiv.com> from Jay Nelson at "Aug 9, 98 02:16:34 pm"
To: freebsd-security@FreeBSD.ORG
Date: Sun, 9 Aug 1998 15:35:42 -0500 (CDT)
X-Mailer: ELM [version 2.4ME+ PL32 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

> >> >traceroute.
> >> 
> >> Did that.
> >
> >I guess I was a bit terse. What *you* are seeing is somebody running
> >traceroute against your machine.
> >
> >traceroute normally starts at port (32768 + 666) and runs up from there.

Some NFS traffic uses somewhat random port #'s as well.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe security" in the body of the message