Re: port 119

[bugtraq () NETWORKICE COM (Robert Graham)]

Port 119 is used by NNTP (USENET news:).

Since USENET is used for lots of illegal/fringe activities, people hunt for
servers that they can post anonymously through, or download content from.
Several websites maintain lists of open NNTP servers found through such
scanning.

BTW, common scans (like this one) are discussed in my "firewall seen" FAQ:
http://www.robertgraham.com/pubs/firewall-seen.html#port119

Regards,
Rob.

-----Original Message-----
From: Incidents Mailing List [mailto:INCIDENTS () securityfocus com]On
Behalf Of Dariusz Zmokly
Sent: Monday, January 03, 2000 3:33 AM
To: INCIDENTS () securityfocus com
Subject: port 119

hi !

I wonder what does it mean when someone wants to connect to my machine on
port 119. Is there any software that could do it or is it a scan ?

Jan  2 01:27:41 rh-master portsentry[444]: attackalert: SYN/Normal scan from
host: jammed.com/165.227.120.19 to TCP port: 119
Jan  3 09:22:52 rh-master portsentry[444]: attackalert: SYN/Normal scan from
host: twhou-220-35.ev1.net/207.218.220.35 to TCP port: 119

best regards :)
Dariusz Zmokly