Re: brightstor/arcserve backup client hacked

On Tue, 1 Mar 2005 11:05:26 -0800 (PST), Andrew Daviel
<[email protected]> wrote:
> 
> Just trying to think if 41523 might be used as a legitimate inbound port
> for http requests, ftp, NFS etc. Maybe. Linux kernel seems to use
> local ports between 1024 & 4999 but a comment says
> "For high-usage systems, use sysctl to change this to 32768-61000".
> Which I presume is legal, so maybe we don't want to statically block
> 41523 at the router indefinitely ... My tcp's rusty - if
> a packet fails on one port will it be retried on another port or the same
> one ?
> 

That would be an inbound source port and you're blocking based on
destination port, so it's a non-issue.  Or for return traffic,
assuming you have a stateful firewall, any return traffic from
connections initiated in your network will get through because of the
existing state entry.

-Chris
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions