From owner-freebsd-security@FreeBSD.ORG  Tue Sep  9 08:25:50 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 25D9916A4BF; Tue,  9 Sep 2003 08:25:50 -0700 (PDT)
Received: from ran.psg.com (ip166.usw12.rb1.bel.nwlink.com [209.20.253.166])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 7995243FEC; Tue,  9 Sep 2003 08:25:49 -0700 (PDT)
	(envelope-from randy@psg.com)
Received: from localhost ([127.0.0.1] helo=ran.psg.com)
	by ran.psg.com with esmtp (Exim 4.22)
	id 19wkNI-000BVo-Hp; Tue, 09 Sep 2003 08:25:48 -0700
From: Randy Bush <randy@psg.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Date: Tue, 9 Sep 2003 08:25:47 -0700
To: Ben Smithurst <ben@FreeBSD.org>
References: <E19wavc-000LTN-VI@ran.psg.com>
	<20030909081309.GA22828@strontium.bh.smithurst.org>
Message-Id: <E19wkNI-000BVo-Hp@ran.psg.com>
cc: freebsd-security@freebsd.org
Subject: Re: is one of my hosts a scanner?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 09 Sep 2003 15:25:50 -0000

>> seq     my host                       victim(s)
>> ---     ----------------              ---------------
>> 24)     192.168.0.2:1121    <-->      216.52.3.2:2703 
>> 25)     192.168.0.2:1122    <-->      216.52.3.4:2703 
>> 39)     192.168.0.2:1124    <-->      216.52.3.2:2703 
> 
> Those hosts are at cloudmark.com, which gets used by
> spamassassin (or some part of it).  Port 2703 is Razor2
> <http://www.sng.ecs.soton.ac.uk/cgi-bin/faq?_recurse=1&file=16> - so
> that fits as well.

<doh!>  thanks.

so tell me, why does the iana think port 2703 is sms-chat?  i.e.,
why is the port used by razor2 not properly registered as a well
known port?

randy