From owner-freebsd-security  Mon Feb  4 10:24:32 2002
Delivered-To: freebsd-security@freebsd.org
Received: from mail.fpsn.net (mail.fpsn.net [63.224.69.57])
	by hub.freebsd.org (Postfix) with ESMTP id B93B737B49C
	for <freebsd-security@FreeBSD.ORG>; Mon,  4 Feb 2002 10:23:55 -0800 (PST)
Received: from fpsn.net (control.fpsn.net [63.224.69.60])
	(authenticated)
	by mail.fpsn.net (8.11.6/8.11.6) with ESMTP id g14IN5m61304;
	Mon, 4 Feb 2002 11:23:05 -0700 (MST)
Message-ID: <3C5ED186.3B2801CF@fpsn.net>
Date: Mon, 04 Feb 2002 11:23:02 -0700
From: Colin Faber <cfaber@fpsn.net>
Organization: fpsn.net, Inc. (http://www.fpsn.net)
X-Mailer: Mozilla 4.78 [en] (Windows NT 5.0; U)
X-Accept-Language: en
MIME-Version: 1.0
To: Martin McCormick <martin@dc.cis.okstate.edu>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: Port 113 Traffic
References: <200202041818.g14IIgM69616@dc.cis.okstate.edu>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi,

cat /etc/services | grep 113
auth            113/tcp    ident tap    #Authentication Service
auth            113/udp    ident tap    #Authentication Service


Martin McCormick wrote:
> 
>         Why might a FreeBSD system be generating traffic on port
> 113?  We have noticed occasional traffic from a FreeBSD system of
> ours to various addresses outside our network on Port 113.
> 
>         If I blocked it altogether with IPFW, would it effect ssh
> in any way?
> 
>         I am theorizing right now that hosts in the big wide
> world are occasionally probing this port and the traffic might be
> a response of some kind, maybe nothing more than "I don't know
> you.  Goodbye!"
> 
>         Hopefully, our sniffer will eventually see one of the
> exchanges and we will have a better idea of what is going on.
> 
> Martin McCormick WB5AGZ  Stillwater, OK
> OSU Center for Computing and Information Services Network Operations Group
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

-- 
Colin Faber
(303) 859-1491
fpsn.net, Inc.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message