OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Odd / random UDP ports listening on my machine?
From: Max Gribov (mgribovLINKSHARE.COM)
Date: Mon Nov 20 2000 - 09:26:44 CST

i have the same thing on my machine, and i connected to the port with
netcat, and after tailing messages and throwing random commands at the
port, i get these kinds of thing (from syslog):

mordor kernel: svc: short len -1, dropping request
mordor last message repeated 6 times
mordor kernel: svc: short len 0, dropping request

i dont know what svc is however... anyone care to clarify?

fire-eyes wrote:

> I first noticed odd UDP ports listening on my system today. At first, it
> was 1032/udp which I belive was reported by nmap as iad3. I am not aware
> of what this is.
>
> I had to reboot, and now I find this:
>
> [00:13:47 Sat Nov 18]
> rootfire-eyes:~ # nmap -p 1024-2000 -sU localhost
>
> Starting nmap V. 2.54BETA3 ( www.insecure.org/nmap/ )
> Interesting ports on localhost (127.0.0.1):
> (The 976 ports scanned but not shown below are in state: closed)
> Port State Service
> 1027/udp open unknown
>
> Nmap run completed -- 1 IP address (1 host up) scanned in 5 seconds
>
> Any idea what the heck is going on here, or how I can figure out what
> this is?
>
> Thank You.
>
> [eof] 

--
Max Gribov
System Administrator
www.linkshare.com