Home page logo
/

basics logo Security Basics mailing list archives

RE: irc port open on 6668/tcp and 6667/tcp
From: Chris Santerre <csanterre () MerchantsOverseas com>
Date: Wed, 12 Feb 2003 16:35:30 -0500

Just so you feel good about it, it is most likely your APC UPS running
Powerchute. But you should run the other programs that others have mentioned
to be on the safe side. 

Try killing the powerchute service and see what happens :)

-----Original Message-----
From: Michael Parker [mailto:mparker () rim net]
Sent: Tuesday, February 11, 2003 12:36 PM
To: security-basics () securityfocus com
Subject: RE: irc port open on 6668/tcp and 6667/tcp


There is a great free program called Vision from Foundstone 
that maps ports to executable and processe, lists running 
applications, etc.  Their orignal program was FPort...this is 
the next generation.  This should help you identify what's 
running, where, and why.

http://www.foundstone.com/knowledge/forensics.html

Cheers,
Michael

-----Original Message-----
From: Nelson, Ernie [mailto:Ernie.Nelson () wizards com]
Sent: February 11, 2003 12:24 PM
To: Harish Gondavale; security-basics () securityfocus com
Subject: RE: irc port open on 6668/tcp and 6667/tcp


I'd grab the fport utility from http://www.foundstone.com/ 
and run it on the PDC to see what process is using those open ports.

Now my question is, why these port are open on PDC? Is
there something suspicious? What should I do to find
the exact reason?   





  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]