Listing of "common" ports used for attacks?
Does anyone know where I can find a listing of ports that are commonly (known) as far as attack attempts? I know that /etc/services.ini is where I can find what I'm supposed to have LOCALLY, but I'm looking for "more" information. I hope that makes sense to someone other than me... Any suggestions would be appreciated. Thanks, Geordon
On Tuesday 26 June 2001 05:03, Geordon VanTassle wrote:
Does anyone know where I can find a listing of ports that are commonly (known) as far as attack attempts? I know that /etc/services.ini is where
.ini?????????
I can find what I'm supposed to have LOCALLY, but I'm looking for "more" information. I hope that makes sense to someone other than me...
Any suggestions would be appreciated.
Thanks, Geordon
www.securityfocus.com, www.cert.org cert.org is by tradition the place to go for security alerts, but afaik a listing of the sort you're looking for isn't available. But when I've found unknown ports in my firewall DENY statements, a search for port ##### on securityfocus has usually given me the info I needed. Regards Anders
Hello Geordon VanTassle, On Mon, Jun 25, 2001 at 10:03:17PM -0500, Geordon VanTassle wrote:
Does anyone know where I can find a listing of ports that are commonly (known) as far as attack attempts? I know that /etc/services.ini is where I can find what I'm supposed to have LOCALLY, but I'm looking for "more" information. I hope that makes sense to someone other than me...
Actually, this is a FAQ, so have a look at http://www.susesecurity.com/faq/index.html in the section "I see port scans to port number xyz - What does this mean? What is this port used for?" HTH Johannes
My big list 'o ports: Protecting information from exposure (part II) lists something like 200 (300? I lost count) common trojan ports. Kurt Seifried, seifried@securityportal.com PGP Key ID: 0xAD56E574 Fingerprint: A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.securityportal.com/
awww crap. I really need to learn to cut and paste: http://www.securityportal.com/firewalls/ports/ Kurt
My big list 'o ports:
Protecting information from exposure (part II)
lists something like 200 (300? I lost count) common trojan ports.
On 26-Jun-01 Geordon VanTassle wrote:
Does anyone know where I can find a listing of ports that are commonly (known) as far as attack attempts?
If you're looking for statistics showing the most recent port probes/scans currently found on the internet you may want to take a look at www.cert.org/current/current_activity.html . Nicely formatted tables, together with links to CERT vulnerability notes and more.
I know that /etc/services.ini is where I can find what I'm supposed to have LOCALLY, but I'm looking for "more" information. I hope that makes sense to someone other than me...
There seems to be an ongoing misunderstanding of the file /etc/services. This file does not, in any way whatsoever, actively start/stop or provide any services at all. From the services(5) man page: "services is a plain ASCII file providing a mapping between friendly textual names for internet services, and their underlying assigned port numbers and protocol types. Every networking program should look into this file to get the port number (and protocol) for its service."
Any suggestions would be appreciated.
For a complete listing of all well-known/assigned ports, look at IANA's web pages at www.iana.org/assignments/port-numbers .
Thanks, Geordon
--- Boris Lorenz <bolo@lupa.de> System Security Admin *nix - *nux ---
participants (5)
-
Anders Johansson -
Boris Lorenz -
Geordon VanTassle -
Johannes Geiger -
Kurt Seifried