Security Incidents: Hits on 64257/tcp

[Crist Clark <crist.clark () GLOBALSTAR COM>]

Over the last few days I have seen a large number of hits on our firewall
at port 64257/tcp. The packets seem to be coming from a wide variety of
hosts all over the net. We seem to go for hours with no hits an then three
or four within 10 minutes to a half-hour (not high intensity at all).

These are not causing any problems, but are very curious. I have not been
able to track down any info on this port number. Do I have a trojan
advertising itself somehow and people are trying to get at it? Is some
misconfigured machine advertising services somewhere that others are
trying to get at? Is this a part of some protocol that we are using that
I am not aware?

The only things I can say about the packets are that they are TCP, the dest.
port is 64257, the source port is random, and the packets are mostly are
mostly 44 bytes with some 48 and a few 60. The fact that they are
apparently coming from a lot of different hosts is what bothers me.

Thanks for any help.
--
Crist J. Clark                                Network Security Engineer
crist.clark () globalstar com                    Globalstar, L.P.
(408) 933-4387                                FAX: (408) 933-4926

The information contained in this e-mail message is confidential,
intended only for the use of the individual or entity named above.  If
the reader of this e-mail is not the intended recipient, or the employee
or agent responsible to deliver it to the intended recipient, you are
hereby notified that any review, dissemination, distribution or copying
of this communication is strictly prohibited.  If you have received this
e-mail in error, please contact postmaster () globalstar com