rpc broadcasts
Pavel Urban <[email protected]>
| Newsgroups | gmane.comp.security.sun |
|---|---|
| Message-ID | <[email protected]> |
Hello,
we're seeing traffic like this on our firewall:
00:00:00.557313 10.0.0.64.39735 > 10.0.0.255.7938: udp 128
00:00:00.557603 10.0.0.64.39735 > 10.0.0.255.111: udp 128
00:00:03.591934 10.0.0.64.39735 > 10.0.0.255.7938: udp 128
00:00:03.592010 10.0.0.64.39735 > 10.0.0.255.111: udp 128
02:00:00.144020 10.0.0.64.39754 > 10.0.0.255.7938: udp 128
02:00:00.144310 10.0.0.64.39754 > 10.0.0.255.111: udp 128
02:00:03.159034 10.0.0.64.39754 > 10.0.0.255.7938: udp 128
02:00:03.159110 10.0.0.64.39754 > 10.0.0.255.111: udp 128
04:00:00.150855 10.0.0.64.39755 > 10.0.0.255.7938: udp 128
04:00:00.150932 10.0.0.64.39755 > 10.0.0.255.111: udp 128
04:00:03.157447 10.0.0.64.39755 > 10.0.0.255.7938: udp 128
04:00:03.157523 10.0.0.64.39755 > 10.0.0.255.111: udp 128
I assume that these broadcasts are somehow related to Solstice Backup
server that is running on this machine. But why broadcasts?
root@backup # rpcinfo -p
program vers proto port service
100000 4 tcp 111 rpcbind
100000 3 tcp 111 rpcbind
100000 2 tcp 111 rpcbind
100000 4 udp 111 rpcbind
100000 3 udp 111 rpcbind
100000 2 udp 111 rpcbind
100024 1 udp 32772 status
100024 1 tcp 32771 status
100133 1 udp 32772
100133 1 tcp 32771
100083 1 tcp 32772
100021 1 udp 4045 nlockmgr
100021 2 udp 4045 nlockmgr
100021 3 udp 4045 nlockmgr
100021 4 udp 4045 nlockmgr
100021 1 tcp 4045 nlockmgr
100021 2 tcp 4045 nlockmgr
100021 3 tcp 4045 nlockmgr
100021 4 tcp 4045 nlockmgr
100249 1 udp 32774
100249 1 tcp 32788
300598 1 udp 32777
300598 1 tcp 32790
805306368 1 udp 32777
805306368 1 tcp 32790
390113 1 tcp 7937 nsrexec
390103 2 tcp 8054 nsrd
390109 2 tcp 8054 nsrstat
390110 1 tcp 8054 nsrjb
390103 2 udp 8055 nsrd
390109 2 udp 8055 nsrstat
390110 1 udp 8055 nsrjb
390107 5 tcp 8003 nsrmmdbd
390107 6 tcp 8003 nsrmmdbd
390105 5 tcp 8052 nsrindexd
390105 6 tcp 8052 nsrindexd
390104 105 tcp 8024 nsrmmd
390104 505 tcp 8073 nsrmmd
390104 905 tcp 8013 nsrmmd
390104 1305 tcp 8070 nsrmmd
--
***********************************************************************
Pavel Urban ([email protected])
IOL system disaster
Internet OnLine, www.iol.cz
***********************************************************************
Vegetables should not operate electronic equipment.
Computer Stupidities, http://rinkworks.com/stupid/
***********************************************************************