Re: Port Scanning on 1026 & 1027

Merton Campbell Crockett <[email protected]> Wed, 27 Jul 2005 08:22:30 -0700 (PDT)

Newsgroups	gmane.comp.security.intrusions
Message-ID	<[email protected]>

On Tue, 26 Jul 2005, Tony Tomasello wrote:

> I have noticed a tremendous amount of scanning on ports 1026 and 1027. Not 
> sure if you all have been experiencing the same. Is this something that I 
> should be concerned about ?

Those are Microsoft Windows Dynamic RPC ports, a.k.a. Web RPC ports.

Normally, I just block the reserved port 1024 and the 3 ports used for Web 
RPC 1025-1027 for both TCP and UDP.

The probes have been going on for at least a year.

Merton Campbell Crockett


-- 
BEGIN:				vcard
VERSION:			3.0
FN:				Merton Campbell Crockett
ORG:				General Dynamics Advanced Information Systems;
				Intelligence and Exploitation Systems
N:				Crockett;Merton;Campbell
EMAIL;TYPE=internet:		[email protected]
TEL;TYPE=work,voice,msg,pref:	+1(805)497-5045
TEL;TYPE=work,fax:		+1(805)497-5050
TEL;TYPE=cell,voice,msg:	+1(805)377-6762
END:				vcard
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions