Re: UDP 22 & 5632

[kos <kos () bastard net>]

These ports are used by PCAnywhere. My guess is someone is scanning for
NT hosts with remote control enabled. For reference, 5632 udp or tcp seems 
to be the "login" port and 5631 udp or tcp the data port. Older versions
used port 22.

Get them to check out the box.

Later,
Kos

| I'm seeing a reoccuring pattern where a system will sequentially scan a
| network over and over and over (sometimes for hours) trying to connect to
| UDP 22 & 5632.  The source port is pretty static, always near (but higher
| than) 1024.
| 
| Anyone with an idea of what this is?  It seems to be running on a Windows
| (most likely NT since the IP is in a co-lo) system.
| 
| -- 
| Aaron Turner        aturner () vicinity com  650.237.0300 x252
| Security Engineer                         Vicinity Corp.        
| Cell: 408-314-9874                        http://www.vicinity.com


--