Dear listmembers ! Our webserver tries to connect to a workstation via Port 3. I've found that TCP/IP-Port 3 is 'compressnet'. But what does is mean. Is it maybe a trojan ? Thanx in advance. ----------- Hi ! Wir haben bei uns einen Webserver, der permanent versucht, eine Workstation auf Port 3 anzusprechen. Die anderen 30 Arbeitsstationen werden nicht auf Port 3 angesprochen. Unsere Firewall fängt den Port 3 zwar ab, aber hat jemand eine Ahnung, welches Programm auf einem Linux-Server so etwas macht...vorallem weil es nur diese eine Arbeitsstation anspricht ?! Ist es vielleicht ein Linux-Trojaner ?! Danke im voraus ! Michael -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net
On Wednesday, 6. February 2002 11:30, chemiegott@gmx.net wrote:
Dear listmembers !
Our webserver tries to connect to a workstation via Port 3. I've found that TCP/IP-Port 3 is 'compressnet'. But what does is mean. Is it maybe a trojan ? Thanx in advance.
I assume you discovered a logging entry in your firewall log. If so, take a look at the protocol that's being logged. I bet it's PROTO=1, ICMP. ICMP doesn't use ports, it uses codes and code 3 means "destination unreachable". The second "port" (subcode) you see shows you a closer explanation - "port unreachable", "host unreachable" and so on.
Danke im voraus !
Büdde.
Michael
Björn
Erggg, thanx. That's it. Anfängerfehler... Michael ;-)
Dear listmembers !
Our webserver tries to connect to a workstation via Port 3. I've found
On Wednesday, 6. February 2002 11:30, chemiegott@gmx.net wrote: that
TCP/IP-Port 3 is 'compressnet'. But what does is mean. Is it maybe a tr ojan ? Thanx in advance.
I assume you discovered a logging entry in your firewall log. If so, take a look at the protocol that's being logged. I bet it's PROTO=1, ICMP. ICMP doesn't use ports, it uses codes and code 3 means "destination unreachable". The second "port" (subcode) you see shows you a closer explanation - "port unreachable", "host unreachable" and so on.
Danke im voraus !
Büdde.
Michael
Björn
-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
-- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net
participants (2)
-
Bjoern Engels
-
chemiegott@gmx.net