TCP/IP ports

[Scott]

I wont add any more links to the well known ports - enough people have 
already done that.

What I would like to add is this:

What you MAY be seeing on port 4081 and other "high" ports (1025+) is the 
outbound traffic from an inbound ftp, telnet, ssh, http, etc.  Although 
these are well known ports and always come in on 21, 23, 22, ... (unless 
you make an effort to have them come in on some other port), they dont 
always leave by the same port.  If you park ethereal or tcpdump on the 
wire and watch, you will see what I mean.  Also, if you have a logging 
firewall or nat box, you can see this behavior there too (although it 
might not be as obvious).

If you want to see a more detailed explanation of how this works, yahoo or 
google for "passive ftp" and/or "active ftp".  Although this explains a 
specific service, you'll get the general idea.

scott b.

ps

I say "MAY be seeing" because it is possible the host in question has been 
compromised.

On Wed, 5 Feb 2003, Scott H wrote:

> I'm trying to track down network traffic on our
> LAN.  I'm seeing very frequent use of upper-level
> ports I don't recognize, like 4081.  Does anyone
> know where you can go to get a comprehensive list
> of what ports are used by what
> systems/applications?  Thanks for any help...
> 
> Scott
> 
> 
> 
> 
> 
> .
> 
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
> http://mailplus.yahoo.com
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change  you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
> 

-- 
NT makes anything simple, easy, and anything difficult to do, impossible.
Unix makes anything easy to do difficult, and anything difficult to do,
possible.  Basically, if your VCR is still flashing "12:00" then unix is not
for you!