Re: port 17027

[Bill_Royds () pch gc ca]

You have people who have installed "adware" with ads from Conducent, shareware
programs that go get advertising to show on the desktop from these sites.  IF
you check HTTP traffic to those same IP's you will find a lot more, but if you
block the HTTP, the programs will try to blow away your network with about 10-15
connect attemtps a second. Best to have companty policy to not install shareware
without permission.
Look in the clients registry for entries for Conducent, Timesink or Aureate.




"Ken Fox" <kenfox () starlinx com> on

Please respond to "Ken Fox" <kenfox () starlinx com>
                                                              
                                                              
                                                              
 To:      firewall-wizards () nfr net                            
                                                              
 cc:      kenfox () starlinx com(bcc: Bill                       
          Royds/HullOttawa/PCH/CA)                            
                                                              
                                                              
                                                              
 Subject: [fw-wiz] port 17027                                 
                                                              





Has anyone seen heavy activity on port 17027 from boxes inside a firewall --
specifically, a number of users systems keep trying to send tcp packets to ip
addresses in the 216.33.0.0 through 216.35.0.0 range with a desitination port of
17027.

That address range is owned by exodus.net , and further the individuals IP
addresses are owned by

%rwhois V-1.5:003fff:00 rwhois.exodus.net (by Network Solutions, Inc. V-1.5.3)
    network:Auth-Area:216.33.0.0/16
    network:Class-Name:network
    network:Network-Name:216.33.208.0
    network:IP-Network:216.33.208.0/20
    network:Organization;I:DIALTONE INTERNET
    network:Address-1;I:18331 Pines Blvd
    network:Address-2;I:Pembroke Pines, FL 33029
    network:Admin-Contact;I:DNS () DIALTONEINTERNET NET
    network:Tech-Contact;I:DNS () DIALTONEINTERNET NET
    network:Created:99-MAY-20
    network:Updated-By:dave

This company provides Datacenter capabilities. Co-location ...


We have been hypothesizing that this could be some ICQ type app or some
malicious bug that someone(s) has/have caught by surfing in the wrong places.

In the cases where we have contacted the owners of the systems sending these
packets, they have been clearly clueless about the traffic emanating from thier
computers.

HAs anyone else seen this?

Thanks, Ken