Security Incidents: Re: unknown port numbers

[andik () DEC COM RO (Kovacs Andrei)]

On Tue, 29 Feb 2000, Rolandas Juodzbalis wrote:

> Where on the net, I can find port<->program(trojan,etc) description?
> There is some strange connection log to my system:
>
> Feb 19 18:44:18 TCP: port 28744 connection attempt from *.*.*.*:62757
> Feb 19 18:44:36 TCP: port 52252 connection attempt from *.*.*.*:62758
> Feb 19 18:45:06 TCP: port 15505 connection attempt from *.*.*.*:62759
> Feb 19 18:45:30 TCP: port 17262 connection attempt from *.*.*.*:62760
> Feb 19 18:48:16 TCP: port 41316 connection attempt from *.*.*.*:62762
Ports over 61000 are usually used on Linux machines running IP Masquerade, so
my guess is that someone behind a Linux Masquerade Proxy portscanned you.

Kovacs Andrei