Security Incidents: port 1150 and 4833 ?

From: Kim R. Rasmussen <kim_at_CHROM.IMBG.KU.DK>
Date: Tue, 4 Jan 2000 23:54:17 +0100

Hello!

I've had some odd port scannings lately going primarily to port 1150 and
4833. I haven't been succesful in finding out what could be of interest on
those ports. Anyone with ideas ? Snippets included.

Best regards,
Kim Rasmussen

---[ IP numbers left out ]---
Dec 30 08:43:17 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:4328 w.x.y.z:111 L=40 S=0x00 I=38248 F=0x400
0 T=47
Dec 30 08:43:20 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:4328 w.x.y.z:111 L=40 S=0x00 I=38524 F=0x400
0 T=47
Dec 30 08:43:22 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:113 w.x.y.z:1150 L=44 S=0x00 I=38559 F=0x000
0 T=47
Dec 30 08:43:25 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:113 w.x.y.z:1150 L=44 S=0x00 I=38878 F=0x000
0 T=47
Dec 30 08:43:26 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:4328 w.x.y.z:111 L=40 S=0x00 I=39129 F=0x400
0 T=47
Dec 30 08:43:31 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:113 w.x.y.z:1150 L=44 S=0x00 I=39699 F=0x000
---[ IP numbers left out ]---
Jan 4 16:23:22 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:1237 w.x.y.z:111 L=52 S=0x00 I=14461 F=0x4
000 T=50
Jan 4 16:23:22 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:113 w.x.y.z:4833 L=52 S=0x00 I=14462 F=0x4
000 T=50
Jan 4 16:23:25 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:113 w.x.y.z:4833 L=52 S=0x00 I=15933 F=0x4
000 T=50
Jan 4 16:23:27 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:113 w.x.y.z:4833 L=87 S=0x00 I=16278 F=0x4
000 T=50
Jan 4 16:23:31 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:113 w.x.y.z:4833 L=52 S=0x00 I=18807 F=0x4
000 T=50
Jan 4 16:23:43 sentryhost kernel: Packet log: input DENY eth0 PROTO=6
a.b.c.d:113 w.x.y.z:4833 L=52 S=0x00 I=23321 F=0x4
000 T=50

---

Received on Jan 05 2000