RE: 2525/tcp anyone?
"Kevin Timm \(timmk\)" <[email protected]> Tue, 17 May 2005 06:34:29 -0700
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <48875BDF6C7A1241A994016BE579B9C315C689@xmb-sjc-22d.amer.cisco.com> |
No idea. Set up a listener to gather the data. Kevin -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Jim Becher Sent: Monday, May 16, 2005 10:22 PM To: [email protected] Subject: [Intrusions] 2525/tcp anyone? Port 2525/tcp has recently broken in to my Top 10 Attacked ports list a couple of times. Google'ing hasn't turned up much -- several references to running an SMTP server on an alternate port, one reference to the suckit rootkit and references to a 2003 Backdoor.Rockse (Symantec). Destinations are only the corporate mailservers. The mailservers are located on completely different address space -- no octets are the same. The sources, which are mostly in the Asia-Pac region, are sending SYNs to both mailservers within seconds of each other. I have had on occasion upwards of 200 sources generating 5000 SYNs per day. DShield shows a slight increase recently, but doesn't appear to be anything dramatic. Officially, 2525/tcp is listed as MS V-Worlds. Got Packets? Why yes... ;) But only from in front of one mailserver at the moment: 05/16-21:35:28.618621 a.b.c.d:2027 -> our.mail.server:2525 TCP TTL:116 TOS:0x0 ID:55457 IpLen:20 DgmLen:60 DF ******S* Seq: 0xFAC8A3EB Ack: 0x0 Win: 0xFAF0 TcpLen: 40 TCP Options (7) => MSS: 1460 NOP NOP TS: 0 0 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+ 05/16-21:35:28.618800 our.mail.server:2525 -> a.b.c.d:2027 TCP TTL:116 TOS:0x0 ID:55457 IpLen:20 DgmLen:60 DF ***A*R** Seq: 0x0 Ack: 0xFAC8A3EC Win: 0xFAF0 TcpLen: 40 TCP Options (7) => MSS: 1460 NOP NOP TS: 0 0 NOP NOP SackOK =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ =+ I don't see any stimulus traffic for the previous 5 hours (in the case of the packets above). Anyone else seeing these and have an idea what this might be? Could this just be some Asia-Pac spammers looking for open SMTP relays on an alternate port? -jim _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions