From owner-freebsd-security@FreeBSD.ORG  Tue Sep  9 15:03:00 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id EA79116A4BF
	for <freebsd-security@freebsd.org>;
	Tue,  9 Sep 2003 15:03:00 -0700 (PDT)
Received: from hysteria.spc.org (hysteria.spc.org [195.206.69.234])
	by mx1.FreeBSD.org (Postfix) with SMTP id AD9FA43FE9
	for <freebsd-security@freebsd.org>;
	Tue,  9 Sep 2003 15:02:58 -0700 (PDT)
	(envelope-from bms@hysteria.spc.org)
Received: (qmail 31738 invoked by uid 5013); 9 Sep 2003 21:59:30 -0000
Date: Tue, 9 Sep 2003 22:59:30 +0100
From: Bruce M Simpson <bms@spc.org>
To: Michael Sierchio <kudzu@tenebras.com>
Message-ID: <20030909215930.GS1417@spc.org>
Mail-Followup-To: Bruce M Simpson <bms@spc.org>,
	Michael Sierchio <kudzu@tenebras.com>, freebsd-security@freebsd.org
References: <69749FD8-E303-11D7-AF9F-000393A335A2@mac.com>
	<3F5E4834.4060409@tenebras.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <3F5E4834.4060409@tenebras.com>
User-Agent: Mutt/1.4.1i
Organization: SPC
cc: freebsd-security@freebsd.org
Subject: Re: is one of my hosts a scanner?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 09 Sep 2003 22:03:01 -0000

On Tue, Sep 09, 2003 at 02:37:56PM -0700, Michael Sierchio wrote:
> IANA *assigns* port numbers 0-1023, and *registers* port numbers 1024-49151.
> 
> There is no port registered for razor2, and it's definitely a bug
> to use a port registered to another service.

Perhaps you should take it up with Cloudmark, as they maintain SpamNet
commercially. They may have had good reasons, though, so don't be too
quick to jump on them for doing it.

One reason I can think of is to be a bit more obfuscated about how the
SpamNet operates, but given that it's a network for *reporting* spam whose
components has deterministic behaviour, it doesn't really throw spammers
off the scent, if they were to sit down and analyse the product.

BMS