Port 12345 is the default port in a windows backdoor software known as "netbus". Port 1243 is the default port in a windows backdoor software known as "subseven". I don't know what the 1099 is, but I didn't look that hard. http://www.sans.org/newlook/resources/IDFAQ/oddports.htm -miah On Thu, Nov 16, 2000 at 10:44:47PM -0000, Charles Price wrote:

Hi All,

Recently, my ipchains script running on SuSE 7.0 has been denying attempts at TCP access to ports:

12345 1243 1099 1099

I checked in /etc/services and found that 1099 is the standard port for RMI Registry. Connections to the above ports were made in rapid succession. Can anyone tell me what port 1099 and the two other unpriveliged ports could mean together?

Thanks,

Charlie