Mailinglist Archive: opensuse-security (685 mails)

< Previous Next >
Re: [suse-security] TCP/IP-Port 3
  • From: Bjoern Engels <bengels@xxxxxxxxxxx>
  • Date: Wed, 6 Feb 2002 11:36:55 +0100
  • Message-id: <0d73f0445100622WEB@xxxxxxxxxxxxxxx>
On Wednesday, 6. February 2002 11:30, chemiegott@xxxxxxx wrote:
> Dear listmembers !
> Our webserver tries to connect to a workstation via Port 3. I've found that
> TCP/IP-Port 3 is 'compressnet'. But what does is mean. Is it maybe a trojan
> ? Thanx in advance.

I assume you discovered a logging entry in your firewall log. If so, take a
look at the protocol that's being logged. I bet it's PROTO=1, ICMP.
ICMP doesn't use ports, it uses codes and code 3 means "destination
unreachable". The second "port" (subcode) you see shows you a closer
explanation - "port unreachable", "host unreachable" and so on.

> Danke im voraus !


> Michael


< Previous Next >
Follow Ups