From owner-freebsd-security  Thu May 17 12: 2:15 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ambar.ofermundo.com.ar (h066060007247.isol.net.ar [66.60.7.247])
	by hub.freebsd.org (Postfix) with ESMTP id 9F8E337B422
	for <freebsd-security@FreeBSD.ORG>; Thu, 17 May 2001 12:02:09 -0700 (PDT)
	(envelope-from freebsd@grunblatt.com.ar)
Received: from dialup202.icatel.net (dialup202.icatel.net [200.47.39.202])
	by ambar.ofermundo.com.ar (8.9.3/8.8.7) with ESMTP id QAA08662;
	Thu, 17 May 2001 16:01:34 -0300
Date: Thu, 17 May 2001 19:02:48 -0300 (ART)
From: Daniel <freebsd@grunblatt.com.ar>
X-X-Sender:  <freebsd@apocalypse.infonegocio.com.ar>
To: Linh Pham <lplist@closedsrc.org>
Cc: Bill Mitcheson <turtle@pyramus.com>,
	<freebsd-security@FreeBSD.ORG>
Subject: Re: Port 1023.
In-Reply-To: <Pine.BSF.4.33.0105171107410.22322-100000@q.closedsrc.org>
Message-ID: <Pine.BSF.4.33.0105171900110.64721-100000@apocalypse.infonegocio.com.ar>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

On Thu, 17 May 2001, Linh Pham wrote:
mountd uses 1023/tcp:

# sockstat
***cut***
root     mountd     243    7 udp4   *:1020                *:*
root     mountd     243    8 tcp4   *:1022                *:*
root     mountd     243   11 udp4   *:1021                *:*
root     mountd     243   12 tcp4   *:1023                *:*
***cut***

Bill: may be a tcpwrapper would help you

d.-

> Date: Thu, 17 May 2001 11:09:07 -0700 (PDT)
> From: Linh Pham <lplist@closedsrc.org>
> To: Bill Mitcheson <turtle@pyramus.com>
> Cc: freebsd-security@FreeBSD.ORG
> Subject: Re: Port 1023.
>
> On 2001-05-17, Bill Mitcheson scribbled:
>
> # We noticed unauthorized activity yesterday. After investigating we found
> # that there was someone coming in from Asia and they were trying to
> # access port 1023. I could not find much info on that port and was
> # wondering if anyone knows of that port, what common attacks to that port
> # are,  and how to stop future attacks?
>
> If I remember correctly, port 1023/tcp is a reserved port set aside...
> port 1022/tcp and 1024/tcp as well.
>
> I don't know of a program that uses 1023/tcp... sorry :(
>
> --
> Linh Pham
> [lplist@closedsrc.org]
>
> // 404b - Brain not found
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message