OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Ports 6667,6668
From: David Ockwell-Jenner (dojNORTELNETWORKS.COM)
Date: Fri May 19 2000 - 14:20:25 CDT

This has also been seen on a selection of NT servers that I have adopted.
Again, a newly built machine with the 'same' (or so I believe) software on
doesn't exhibit this trait.

Anyone have any knowledge on what these are (aside from IRC - I've confirmed
them not to be that!)

-----Original Message-----
From: Ryan Casey [mailto:caseyryCS.EARLHAM.EDU]
Sent: May 19, 2000 12:19 PM
To: FOCUS-MSSECURITYFOCUS.COM
Subject: Ports 6667,6668

I ran nmap recently against our servers and found the following
ports open on several of our servers:

6667/tcp open irc
6668/tcp open irc

We should not have any IRC servers running on our servers. Would NT have
these ports open for any legitimate reason? I just rebuilt another
server, and it does not have these ports open. I've checked the services
control panel, and I didn't see anything that jumped out at me, but any
help would be appreciated.

Also, is there a way to connect open ports with processes?

Our servers are NT 4 SP5.

Thanks,
Ryan Casey