From owner-freebsd-security  Fri May 25 11:28: 9 2001
Delivered-To: freebsd-security@freebsd.org
Received: from earth.backplane.com (earth-nat-cw.backplane.com [208.161.114.67])
	by hub.freebsd.org (Postfix) with ESMTP id 987B737B422
	for <freebsd-security@FreeBSD.ORG>; Fri, 25 May 2001 11:28:07 -0700 (PDT)
	(envelope-from dillon@earth.backplane.com)
Received: (from dillon@localhost)
	by earth.backplane.com (8.11.3/8.11.2) id f4PIS1Y41320;
	Fri, 25 May 2001 11:28:01 -0700 (PDT)
	(envelope-from dillon)
Date: Fri, 25 May 2001 11:28:01 -0700 (PDT)
From: Matt Dillon <dillon@earth.backplane.com>
Message-Id: <200105251828.f4PIS1Y41320@earth.backplane.com>
To: Raoul Schroeder <memphis_ms@gmx.net>
Cc: FreeBSD Security <freebsd-security@FreeBSD.ORG>
Subject: Re: 'nother IPFW question
References:  <3B0EA2AE.5B00EB2@gmx.net>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


:IPFW caught a TCP packet leaving my port 1119 going to another port 113
:I am a little worried about this, since there is nothing running on my
:machine on 1119 that I know of.
:
:Is there a good way of finding out what is sending on port 1119? I am
:only learning about securing my box, and it is hard to find all the info
:I need.
:
:Thank you so much,
:
:Raoul

     Sounds like one of your users simply ran a pop based mail program.

					-Matt

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message