Re: [suse-security] Port 13139 - attack?

Thanks, tracked it down and someone recently installed gamespy on their computer. Needless to say it has been uninstalled at this time. They could get out but noone running Gamespy could see in due to the firewall blocking high ports. Thanks for the response. Jim 02/16/02 03:59:36 PM, "Michael Stern" wrote:

afaik fallout (http://www.interplay.com/falloutbos/) uses this port.

and the snort.org - port database reports

...

...

Port 13139 / udp Keyword gamespy arcade ping

<<

----- Original Message ----- From: "James Bliss" To: Sent: Saturday, February 16, 2002 9:40 PM Subject: [suse-security] Port 13139 - attack?

...

I am getting a whole series of probes on port 13139 all of a sudden in my firewall log. This started out of the blue about 6 days ago. There will be a string of them coming from a multitude of different IP addresses within a matter of seconds (I would imagine spoofing of the IPs from nmap or a similar tool).

Of course the SuSE firewall2 is dropping all of them, but they continue.

Has anyone else seen this happen recently. Is there a new attack of some sort which is directed to port 13139? I have never noticed this specific port before with so many hits and now it is starting to rival the old nimba entries in my logs.

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here