RE: Strange set of TCP ports

["Benjamin Tomhave" <falcon () secureconsulting net>]

tcpview.exe from SysInternals will show ports mapped to processes and their
state -- it's good for both TCP and UDP services
http://www.sysinternals.com/ntw2k/source/tcpview.shtml

> -----Original Message-----
> From: mgotts () 2roads com [mailto:mgotts () 2roads com]
> Sent: Monday, April 19, 2004 4:10 PM
> To: Harlan Carvey
> Cc: Incidents; Raistlin
> Subject: Re: Strange set of TCP ports
>
>
> > Run openports.exe from DiamondCS on the suspect boxen.
> >  If you don't have physical access, but do have admin
> > access, use psexec.exe from SysInternals, as well.
>
> psexec.exe from SysInternals is a remote program execution utility. I use
> it now and then, and am not aware of any capability to have it list ports
> in use and what programs are using them.
>
> SysInternals probably does have such a utility, but I'm not sure what it
> is off the top of my head.
>
> -- Mark
>
> > --- Raistlin <raistlin () gioco net> wrote:
> > > Greetings,
> > >
> > > can someone help me in identifying the following
> > > strange subset of open
> > > TCP ports ?
> > > 3687/tcp open  unknown
> > > 3688/tcp open  unknown
> > > 3689/tcp open  rendezvous
> > > 3690/tcp open  unknown
> > > 3691/tcp open  unknown
> > >
> > > Googling or looking at the usual known ports lists
> > > do not yield any
> > > results. I'd like to identify this beast if
> > > possible. Thanks in advance.
> > >
> > > Stefano
> ------------------------------------------------------------------
> ---------
> > >
> ------------------------------------------------------------------
> ----------
> > >
> ------------------------------------------------------------------
> ---------
> >
> ------------------------------------------------------------------
> ----------
> >
>
> > ForwardSourceID:NT000844F2
>
> ------------------------------------------------------------------
> ---------
> ------------------------------------------------------------------
> ----------


---------------------------------------------------------------------------
----------------------------------------------------------------------------