Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Computer Security > port 113 hits

Reply
Thread Tools

port 113 hits

 
 
reshman
Guest
Posts: n/a
 
      10-17-2003
Anyone have any ideas why I would be seeing hits directed to my on port
113 -- all around the same time? Would this have anything to do with doing
a make for a port out of the ports package???

Thanks!

-Mike

21:49:25.439687 204.152.189.120.36950 > x.x.x.x.113: SWE
3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp 1583556088
0,nop,wscale 0> (DF)
21:49:28.434534 204.152.189.120.36950 > x.x.x.x.113: SWE
3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp 1583556388
0,nop,wscale 0> (DF)
21:49:34.437467 204.152.189.120.36950 > x.x.x.x.113: SWE
3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp 1583556988
0,nop,wscale 0> (DF)
21:49:52.223520 212.50.10.144.51429 > x.x.x.x.113: S
2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334979793
0,nop,wscale 0> (DF) [tos
0x80]
21:49:55.215158 212.50.10.144.51429 > x.x.x.x.113: S
2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334980093
0,nop,wscale 0> (DF) [tos
0x80]
21:50:01.214326 212.50.10.144.51429 > x.x.x.x.113: S
2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334980693
0,nop,wscale 0> (DF) [tos
0x80]
21:50:08.110055 200.89.74.17.1288 > x.x.x.x.113: S 3341661485:3341661485(0)
win 5840 <mss 1380,sackOK,timestamp 536892450 0,nop,wscale 0> (DF)
21:50:11.107743 200.89.74.17.1288 > x.x.x.x.113: S 3341661485:3341661485(0)
win 5840 <mss 1380,sackOK,timestamp 536892750 0,nop,wscale 0> (DF)
21:50:17.107070 200.89.74.17.1288 > x.x.x.x.113: S 3341661485:3341661485(0)
win 5840 <mss 1380,sackOK,timestamp 536893350 0,nop,wscale 0> (DF)
21:50:31.272679 195.113.161.73.35431 > x.x.x.x.113: SWE
1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp 143467926
0,nop,wscale 0> (DF)
21:50:34.271355 195.113.161.73.35431 > x.x.x.x.113: SWE
1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp 143468226
0,nop,wscale 0> (DF)
21:50:40.272963 195.113.161.73.35431 > x.x.x.x.113: SWE
1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp 143468826
0,nop,wscale 0> (DF)
21:50:50.507109 194.192.187.79.48444 > x.x.x.x.113: S
4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541401740
0,nop,wscale 0> (DF)
21:50:53.503095 194.192.187.79.48444 > x.x.x.x.113: S
4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541402040
0,nop,wscale 0> (DF)
21:50:59.501702 194.192.187.79.48444 > x.x.x.x.113: S
4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541402640
0,nop,wscale 0> (DF)
21:51:04.856518 150.244.30.38.38896 > x.x.x.x.113: SWE
3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92006782
0,nop,wscale 1> (DF)
21:51:07.854746 150.244.30.38.38896 > x.x.x.x.113: SWE
3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92007082
0,nop,wscale 1> (DF)
21:51:13.853151 150.244.30.38.38896 > x.x.x.x.113: SWE
3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92007682
0,nop,wscale 1> (DF)
21:51:19.770478 212.27.32.66.45304 > x.x.x.x.113: S 2373501279:2373501279(0)
win 5840 <mss 1460,sackOK,timestamp 135424502 0,nop,wscale 0> (DF)
21:51:22.765533 212.27.32.66.45304 > x.x.x.x.113: S 2373501279:2373501279(0)
win 5840 <mss 1460,sackOK,timestamp 135424802 0,nop,wscale 0> (DF)
21:51:28.763736 212.27.32.66.45304 > x.x.x.x.113: S 2373501279:2373501279(0)
win 5840 <mss 1460,sackOK,timestamp 135425402 0,nop,wscale 0> (DF)
21:52:57.302026 130.239.18.137.33709 > x.x.x.x.113: S
2240511777:2240511777(0) win 65535 <mss 1448,nop,wscale 2,nop,nop,timestamp
1068794865 0>
21:53:03.217878 130.239.18.137.33709 > x.x.x.x.113: S
2240511777:2240511777(0) win 65535 <mss 1448,nop,wscale 2,nop,nop,timestamp
1068794876 0>
21:53:09.977973 164.8.6.249.37812 > x.x.x.x.113: S 1734835097:1734835097(0)
win 5840 <mss 1460,sackOK,timestamp 99930917 0,nop,wscale 0> (DF)
21:53:12.970276 164.8.6.249.37812 > x.x.x.x.113: S 1734835097:1734835097(0)
win 5840 <mss 1460,sackOK,timestamp 99931217 0,nop,wscale 0> (DF)
21:53:27.671416 203.8.116.111.53094 > x.x.x.x.113: SWE
3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp 515950438
0,nop,wscale 0> (DF)
21:53:30.666828 203.8.116.111.53094 > x.x.x.x.113: SWE
3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp 515950738
0,nop,wscale 0> (DF)
21:53:36.665948 203.8.116.111.53094 > x.x.x.x.113: SWE
3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp 515951338
0,nop,wscale 0> (DF)
21:56:17.252274 200.203.120.200.1649 > x.x.x.x.1434: udp 376
22:05:56.676950 128.121.116.162.4479 > x.x.x.x.113: S
3099755125:3099755125(0) win 16384 <mss 1460> (DF)
22:05:59.668883 128.121.116.162.4479 > x.x.x.x.113: S
3099755125:3099755125(0) win 16384 <mss 1460> (DF)
22:06:02.668756 128.121.116.162.4479 > x.x.x.x.113: S
3099755125:3099755125(0) win 16384 <mss 1460> (DF)
22:06:05.668668 128.121.116.162.4479 > x.x.x.x.113: S
3099755125:3099755125(0) win 16384 <mss 1460> (DF)


 
Reply With Quote
 
 
 
 
Vanguard
Guest
Posts: n/a
 
      10-17-2003
Port 133 is for IDENT/auth protocol. Some old mail servers still use it
and why routers might not stealth that port (because they don't want to
be known as incompatible with e-mail). My router will even ignore a
firewall defined within it to BLOCK on that port; http://grc.com
Shield's Up still detected the port. I had to define port 113 went to a
host that doesn't exist (and can never exist because the router's DHCP
server can never assigned that IP address). Basically I defined a
virtual server that doesn't exist so any IDENT/auth request vapories
into a bit bucket. See http://grc.com/port_113.htm. Sounds like
someone is probing around to see if you run an ident server and will
report yourself to the probe.

--
__________________________________________________ __________
*** Post replies to newsgroup. E-mail is not accepted. ***
__________________________________________________ __________


"reshman" <marjunk*NO-SPAM*@charter.net> wrote in message
news:(E-Mail Removed)...
> Anyone have any ideas why I would be seeing hits directed to my on

port
> 113 -- all around the same time? Would this have anything to do with

doing
> a make for a port out of the ports package???
>
> Thanks!
>
> -Mike
>
> 21:49:25.439687 204.152.189.120.36950 > x.x.x.x.113: SWE
> 3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp

1583556088
> 0,nop,wscale 0> (DF)
> 21:49:28.434534 204.152.189.120.36950 > x.x.x.x.113: SWE
> 3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp

1583556388
> 0,nop,wscale 0> (DF)
> 21:49:34.437467 204.152.189.120.36950 > x.x.x.x.113: SWE
> 3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp

1583556988
> 0,nop,wscale 0> (DF)
> 21:49:52.223520 212.50.10.144.51429 > x.x.x.x.113: S
> 2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334979793
> 0,nop,wscale 0> (DF) [tos
> 0x80]
> 21:49:55.215158 212.50.10.144.51429 > x.x.x.x.113: S
> 2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334980093
> 0,nop,wscale 0> (DF) [tos
> 0x80]
> 21:50:01.214326 212.50.10.144.51429 > x.x.x.x.113: S
> 2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334980693
> 0,nop,wscale 0> (DF) [tos
> 0x80]
> 21:50:08.110055 200.89.74.17.1288 > x.x.x.x.113: S

3341661485:3341661485(0)
> win 5840 <mss 1380,sackOK,timestamp 536892450 0,nop,wscale 0> (DF)
> 21:50:11.107743 200.89.74.17.1288 > x.x.x.x.113: S

3341661485:3341661485(0)
> win 5840 <mss 1380,sackOK,timestamp 536892750 0,nop,wscale 0> (DF)
> 21:50:17.107070 200.89.74.17.1288 > x.x.x.x.113: S

3341661485:3341661485(0)
> win 5840 <mss 1380,sackOK,timestamp 536893350 0,nop,wscale 0> (DF)
> 21:50:31.272679 195.113.161.73.35431 > x.x.x.x.113: SWE
> 1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp 143467926
> 0,nop,wscale 0> (DF)
> 21:50:34.271355 195.113.161.73.35431 > x.x.x.x.113: SWE
> 1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp 143468226
> 0,nop,wscale 0> (DF)
> 21:50:40.272963 195.113.161.73.35431 > x.x.x.x.113: SWE
> 1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp 143468826
> 0,nop,wscale 0> (DF)
> 21:50:50.507109 194.192.187.79.48444 > x.x.x.x.113: S
> 4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541401740
> 0,nop,wscale 0> (DF)
> 21:50:53.503095 194.192.187.79.48444 > x.x.x.x.113: S
> 4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541402040
> 0,nop,wscale 0> (DF)
> 21:50:59.501702 194.192.187.79.48444 > x.x.x.x.113: S
> 4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541402640
> 0,nop,wscale 0> (DF)
> 21:51:04.856518 150.244.30.38.38896 > x.x.x.x.113: SWE
> 3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92006782
> 0,nop,wscale 1> (DF)
> 21:51:07.854746 150.244.30.38.38896 > x.x.x.x.113: SWE
> 3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92007082
> 0,nop,wscale 1> (DF)
> 21:51:13.853151 150.244.30.38.38896 > x.x.x.x.113: SWE
> 3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92007682
> 0,nop,wscale 1> (DF)
> 21:51:19.770478 212.27.32.66.45304 > x.x.x.x.113: S

2373501279:2373501279(0)
> win 5840 <mss 1460,sackOK,timestamp 135424502 0,nop,wscale 0> (DF)
> 21:51:22.765533 212.27.32.66.45304 > x.x.x.x.113: S

2373501279:2373501279(0)
> win 5840 <mss 1460,sackOK,timestamp 135424802 0,nop,wscale 0> (DF)
> 21:51:28.763736 212.27.32.66.45304 > x.x.x.x.113: S

2373501279:2373501279(0)
> win 5840 <mss 1460,sackOK,timestamp 135425402 0,nop,wscale 0> (DF)
> 21:52:57.302026 130.239.18.137.33709 > x.x.x.x.113: S
> 2240511777:2240511777(0) win 65535 <mss 1448,nop,wscale

2,nop,nop,timestamp
> 1068794865 0>
> 21:53:03.217878 130.239.18.137.33709 > x.x.x.x.113: S
> 2240511777:2240511777(0) win 65535 <mss 1448,nop,wscale

2,nop,nop,timestamp
> 1068794876 0>
> 21:53:09.977973 164.8.6.249.37812 > x.x.x.x.113: S

1734835097:1734835097(0)
> win 5840 <mss 1460,sackOK,timestamp 99930917 0,nop,wscale 0> (DF)
> 21:53:12.970276 164.8.6.249.37812 > x.x.x.x.113: S

1734835097:1734835097(0)
> win 5840 <mss 1460,sackOK,timestamp 99931217 0,nop,wscale 0> (DF)
> 21:53:27.671416 203.8.116.111.53094 > x.x.x.x.113: SWE
> 3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp 515950438
> 0,nop,wscale 0> (DF)
> 21:53:30.666828 203.8.116.111.53094 > x.x.x.x.113: SWE
> 3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp 515950738
> 0,nop,wscale 0> (DF)
> 21:53:36.665948 203.8.116.111.53094 > x.x.x.x.113: SWE
> 3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp 515951338
> 0,nop,wscale 0> (DF)
> 21:56:17.252274 200.203.120.200.1649 > x.x.x.x.1434: udp 376
> 22:05:56.676950 128.121.116.162.4479 > x.x.x.x.113: S
> 3099755125:3099755125(0) win 16384 <mss 1460> (DF)
> 22:05:59.668883 128.121.116.162.4479 > x.x.x.x.113: S
> 3099755125:3099755125(0) win 16384 <mss 1460> (DF)
> 22:06:02.668756 128.121.116.162.4479 > x.x.x.x.113: S
> 3099755125:3099755125(0) win 16384 <mss 1460> (DF)
> 22:06:05.668668 128.121.116.162.4479 > x.x.x.x.113: S
> 3099755125:3099755125(0) win 16384 <mss 1460> (DF)
>
>



 
Reply With Quote
 
 
 
 
Donald Jacobsen
Guest
Posts: n/a
 
      10-17-2003
Mike,

As someone else pointed out, port 113 is your ident server's port. The
most common reasons that your ident server would be probed would be either
a) as part of a general, overall port scan, or b) you're connecting to an
IRC server.

Because all of these hits were at roughly the same time, it's unlikely
that they're part of a port scan. Do you use a program such as Trillian to
connect to multiple IRC servers?

It may also be a DDoS attempt, but that's doubtful at best.

--Donald

"reshman" <marjunk*NO-SPAM*@charter.net> wrote in message
news:(E-Mail Removed)...
> Anyone have any ideas why I would be seeing hits directed to my on port
> 113 -- all around the same time? Would this have anything to do with

doing
> a make for a port out of the ports package???
>
> Thanks!
>
> -Mike
>
> 21:49:25.439687 204.152.189.120.36950 > x.x.x.x.113: SWE
> 3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp 1583556088

<log snipped>
> 22:06:05.668668 128.121.116.162.4479 > x.x.x.x.113: S
> 3099755125:3099755125(0) win 16384 <mss 1460> (DF)



 
Reply With Quote
 
reshman
Guest
Posts: n/a
 
      10-17-2003
That's the odd thing -- I don't use IRC or any such application. And the
addresses listed resolve to a bunch of debian-related sites (at least based
on the names).

The only thing I had going on at the time was installing a port out of the
ports package, which would have been invoking FTPs to the necessary sites.

Weird.....

Thanks for your feedback.

-Mike

"Donald Jacobsen" <(E-Mail Removed)> wrote in message
news:yqTjb.8395$(E-Mail Removed)...
> Mike,
>
> As someone else pointed out, port 113 is your ident server's port. The
> most common reasons that your ident server would be probed would be either
> a) as part of a general, overall port scan, or b) you're connecting to an
> IRC server.
>
> Because all of these hits were at roughly the same time, it's unlikely
> that they're part of a port scan. Do you use a program such as Trillian to
> connect to multiple IRC servers?
>
> It may also be a DDoS attempt, but that's doubtful at best.
>
> --Donald
>
> "reshman" <marjunk*NO-SPAM*@charter.net> wrote in message
> news:(E-Mail Removed)...
> > Anyone have any ideas why I would be seeing hits directed to my on port
> > 113 -- all around the same time? Would this have anything to do with

> doing
> > a make for a port out of the ports package???
> >
> > Thanks!
> >
> > -Mike
> >
> > 21:49:25.439687 204.152.189.120.36950 > x.x.x.x.113: SWE
> > 3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp 1583556088

> <log snipped>
> > 22:06:05.668668 128.121.116.162.4479 > x.x.x.x.113: S
> > 3099755125:3099755125(0) win 16384 <mss 1460> (DF)

>
>



 
Reply With Quote
 
Tommy
Guest
Posts: n/a
 
      10-17-2003
reshman wrote:

> Anyone have any ideas why I would be seeing hits directed to my on port
> 113 -- all around the same time? Would this have anything to do with
> doing a make for a port out of the ports package???
>
> Thanks!
>
> -Mike


What O/S are you using?

> 21:49:25.439687 204.152.189.120.36950 > x.x.x.x.113: SWE
> 3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp 1583556088
> 0,nop,wscale 0> (DF)
> 21:49:28.434534 204.152.189.120.36950 > x.x.x.x.113: SWE
> 3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp 1583556388
> 0,nop,wscale 0> (DF)
> 21:49:34.437467 204.152.189.120.36950 > x.x.x.x.113: SWE
> 3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp 1583556988
> 0,nop,wscale 0> (DF)
> 21:49:52.223520 212.50.10.144.51429 > x.x.x.x.113: S
> 2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334979793
> 0,nop,wscale 0> (DF) [tos
> 0x80]
> 21:49:55.215158 212.50.10.144.51429 > x.x.x.x.113: S
> 2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334980093
> 0,nop,wscale 0> (DF) [tos
> 0x80]
> 21:50:01.214326 212.50.10.144.51429 > x.x.x.x.113: S
> 2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334980693
> 0,nop,wscale 0> (DF) [tos
> 0x80]
> 21:50:08.110055 200.89.74.17.1288 > x.x.x.x.113: S
> 3341661485:3341661485(0) win 5840 <mss 1380,sackOK,timestamp 536892450
> 0,nop,wscale 0> (DF) 21:50:11.107743 200.89.74.17.1288 > x.x.x.x.113: S
> 3341661485:3341661485(0) win 5840 <mss 1380,sackOK,timestamp 536892750
> 0,nop,wscale 0> (DF) 21:50:17.107070 200.89.74.17.1288 > x.x.x.x.113: S
> 3341661485:3341661485(0) win 5840 <mss 1380,sackOK,timestamp 536893350
> 0,nop,wscale 0> (DF) 21:50:31.272679 195.113.161.73.35431 > x.x.x.x.113:
> SWE 1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp 143467926
> 0,nop,wscale 0> (DF)
> 21:50:34.271355 195.113.161.73.35431 > x.x.x.x.113: SWE
> 1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp 143468226
> 0,nop,wscale 0> (DF)
> 21:50:40.272963 195.113.161.73.35431 > x.x.x.x.113: SWE
> 1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp 143468826
> 0,nop,wscale 0> (DF)
> 21:50:50.507109 194.192.187.79.48444 > x.x.x.x.113: S
> 4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541401740
> 0,nop,wscale 0> (DF)
> 21:50:53.503095 194.192.187.79.48444 > x.x.x.x.113: S
> 4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541402040
> 0,nop,wscale 0> (DF)
> 21:50:59.501702 194.192.187.79.48444 > x.x.x.x.113: S
> 4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541402640
> 0,nop,wscale 0> (DF)
> 21:51:04.856518 150.244.30.38.38896 > x.x.x.x.113: SWE
> 3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92006782
> 0,nop,wscale 1> (DF)
> 21:51:07.854746 150.244.30.38.38896 > x.x.x.x.113: SWE
> 3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92007082
> 0,nop,wscale 1> (DF)
> 21:51:13.853151 150.244.30.38.38896 > x.x.x.x.113: SWE
> 3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92007682
> 0,nop,wscale 1> (DF)
> 21:51:19.770478 212.27.32.66.45304 > x.x.x.x.113: S
> 2373501279:2373501279(0) win 5840 <mss 1460,sackOK,timestamp 135424502
> 0,nop,wscale 0> (DF) 21:51:22.765533 212.27.32.66.45304 > x.x.x.x.113: S
> 2373501279:2373501279(0) win 5840 <mss 1460,sackOK,timestamp 135424802
> 0,nop,wscale 0> (DF) 21:51:28.763736 212.27.32.66.45304 > x.x.x.x.113: S
> 2373501279:2373501279(0) win 5840 <mss 1460,sackOK,timestamp 135425402
> 0,nop,wscale 0> (DF) 21:52:57.302026 130.239.18.137.33709 > x.x.x.x.113: S
> 2240511777:2240511777(0) win 65535 <mss 1448,nop,wscale
> 2,nop,nop,timestamp 1068794865 0>
> 21:53:03.217878 130.239.18.137.33709 > x.x.x.x.113: S
> 2240511777:2240511777(0) win 65535 <mss 1448,nop,wscale
> 2,nop,nop,timestamp 1068794876 0>
> 21:53:09.977973 164.8.6.249.37812 > x.x.x.x.113: S
> 1734835097:1734835097(0) win 5840 <mss 1460,sackOK,timestamp 99930917
> 0,nop,wscale 0> (DF) 21:53:12.970276 164.8.6.249.37812 > x.x.x.x.113: S
> 1734835097:1734835097(0) win 5840 <mss 1460,sackOK,timestamp 99931217
> 0,nop,wscale 0> (DF) 21:53:27.671416 203.8.116.111.53094 > x.x.x.x.113:
> SWE 3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp 515950438
> 0,nop,wscale 0> (DF)
> 21:53:30.666828 203.8.116.111.53094 > x.x.x.x.113: SWE
> 3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp 515950738
> 0,nop,wscale 0> (DF)
> 21:53:36.665948 203.8.116.111.53094 > x.x.x.x.113: SWE
> 3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp 515951338
> 0,nop,wscale 0> (DF)
> 21:56:17.252274 200.203.120.200.1649 > x.x.x.x.1434: udp 376
> 22:05:56.676950 128.121.116.162.4479 > x.x.x.x.113: S
> 3099755125:3099755125(0) win 16384 <mss 1460> (DF)
> 22:05:59.668883 128.121.116.162.4479 > x.x.x.x.113: S
> 3099755125:3099755125(0) win 16384 <mss 1460> (DF)
> 22:06:02.668756 128.121.116.162.4479 > x.x.x.x.113: S
> 3099755125:3099755125(0) win 16384 <mss 1460> (DF)
> 22:06:05.668668 128.121.116.162.4479 > x.x.x.x.113: S
> 3099755125:3099755125(0) win 16384 <mss 1460> (DF)


 
Reply With Quote
 
reshman
Guest
Posts: n/a
 
      10-17-2003
FreeBSD 5.1

"Tommy" <(E-Mail Removed)> wrote in message
news:1911390.QYd4ZJqnt5@FreeBSD...
> reshman wrote:
>
> > Anyone have any ideas why I would be seeing hits directed to my on port
> > 113 -- all around the same time? Would this have anything to do with
> > doing a make for a port out of the ports package???
> >
> > Thanks!
> >
> > -Mike

>
> What O/S are you using?
>
> > 21:49:25.439687 204.152.189.120.36950 > x.x.x.x.113: SWE
> > 3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp 1583556088
> > 0,nop,wscale 0> (DF)
> > 21:49:28.434534 204.152.189.120.36950 > x.x.x.x.113: SWE
> > 3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp 1583556388
> > 0,nop,wscale 0> (DF)
> > 21:49:34.437467 204.152.189.120.36950 > x.x.x.x.113: SWE
> > 3966116226:3966116226(0) win 5840 <mss 1460,sackOK,timestamp 1583556988
> > 0,nop,wscale 0> (DF)
> > 21:49:52.223520 212.50.10.144.51429 > x.x.x.x.113: S
> > 2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334979793
> > 0,nop,wscale 0> (DF) [tos
> > 0x80]
> > 21:49:55.215158 212.50.10.144.51429 > x.x.x.x.113: S
> > 2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334980093
> > 0,nop,wscale 0> (DF) [tos
> > 0x80]
> > 21:50:01.214326 212.50.10.144.51429 > x.x.x.x.113: S
> > 2262108815:2262108815(0) win 5840 <mss 1460,sackOK,timestamp 334980693
> > 0,nop,wscale 0> (DF) [tos
> > 0x80]
> > 21:50:08.110055 200.89.74.17.1288 > x.x.x.x.113: S
> > 3341661485:3341661485(0) win 5840 <mss 1380,sackOK,timestamp 536892450
> > 0,nop,wscale 0> (DF) 21:50:11.107743 200.89.74.17.1288 > x.x.x.x.113: S
> > 3341661485:3341661485(0) win 5840 <mss 1380,sackOK,timestamp 536892750
> > 0,nop,wscale 0> (DF) 21:50:17.107070 200.89.74.17.1288 > x.x.x.x.113: S
> > 3341661485:3341661485(0) win 5840 <mss 1380,sackOK,timestamp 536893350
> > 0,nop,wscale 0> (DF) 21:50:31.272679 195.113.161.73.35431 > x.x.x.x.113:
> > SWE 1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp

143467926
> > 0,nop,wscale 0> (DF)
> > 21:50:34.271355 195.113.161.73.35431 > x.x.x.x.113: SWE
> > 1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp 143468226
> > 0,nop,wscale 0> (DF)
> > 21:50:40.272963 195.113.161.73.35431 > x.x.x.x.113: SWE
> > 1772927044:1772927044(0) win 5840 <mss 1460,sackOK,timestamp 143468826
> > 0,nop,wscale 0> (DF)
> > 21:50:50.507109 194.192.187.79.48444 > x.x.x.x.113: S
> > 4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541401740
> > 0,nop,wscale 0> (DF)
> > 21:50:53.503095 194.192.187.79.48444 > x.x.x.x.113: S
> > 4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541402040
> > 0,nop,wscale 0> (DF)
> > 21:50:59.501702 194.192.187.79.48444 > x.x.x.x.113: S
> > 4051693887:4051693887(0) win 5840 <mss 1460,sackOK,timestamp 541402640
> > 0,nop,wscale 0> (DF)
> > 21:51:04.856518 150.244.30.38.38896 > x.x.x.x.113: SWE
> > 3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92006782
> > 0,nop,wscale 1> (DF)
> > 21:51:07.854746 150.244.30.38.38896 > x.x.x.x.113: SWE
> > 3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92007082
> > 0,nop,wscale 1> (DF)
> > 21:51:13.853151 150.244.30.38.38896 > x.x.x.x.113: SWE
> > 3991035608:3991035608(0) win 5840 <mss 1460,sackOK,timestamp 92007682
> > 0,nop,wscale 1> (DF)
> > 21:51:19.770478 212.27.32.66.45304 > x.x.x.x.113: S
> > 2373501279:2373501279(0) win 5840 <mss 1460,sackOK,timestamp 135424502
> > 0,nop,wscale 0> (DF) 21:51:22.765533 212.27.32.66.45304 > x.x.x.x.113: S
> > 2373501279:2373501279(0) win 5840 <mss 1460,sackOK,timestamp 135424802
> > 0,nop,wscale 0> (DF) 21:51:28.763736 212.27.32.66.45304 > x.x.x.x.113: S
> > 2373501279:2373501279(0) win 5840 <mss 1460,sackOK,timestamp 135425402
> > 0,nop,wscale 0> (DF) 21:52:57.302026 130.239.18.137.33709 > x.x.x.x.113:

S
> > 2240511777:2240511777(0) win 65535 <mss 1448,nop,wscale
> > 2,nop,nop,timestamp 1068794865 0>
> > 21:53:03.217878 130.239.18.137.33709 > x.x.x.x.113: S
> > 2240511777:2240511777(0) win 65535 <mss 1448,nop,wscale
> > 2,nop,nop,timestamp 1068794876 0>
> > 21:53:09.977973 164.8.6.249.37812 > x.x.x.x.113: S
> > 1734835097:1734835097(0) win 5840 <mss 1460,sackOK,timestamp 99930917
> > 0,nop,wscale 0> (DF) 21:53:12.970276 164.8.6.249.37812 > x.x.x.x.113: S
> > 1734835097:1734835097(0) win 5840 <mss 1460,sackOK,timestamp 99931217
> > 0,nop,wscale 0> (DF) 21:53:27.671416 203.8.116.111.53094 > x.x.x.x.113:
> > SWE 3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp

515950438
> > 0,nop,wscale 0> (DF)
> > 21:53:30.666828 203.8.116.111.53094 > x.x.x.x.113: SWE
> > 3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp 515950738
> > 0,nop,wscale 0> (DF)
> > 21:53:36.665948 203.8.116.111.53094 > x.x.x.x.113: SWE
> > 3187565637:3187565637(0) win 5840 <mss 1460,sackOK,timestamp 515951338
> > 0,nop,wscale 0> (DF)
> > 21:56:17.252274 200.203.120.200.1649 > x.x.x.x.1434: udp 376
> > 22:05:56.676950 128.121.116.162.4479 > x.x.x.x.113: S
> > 3099755125:3099755125(0) win 16384 <mss 1460> (DF)
> > 22:05:59.668883 128.121.116.162.4479 > x.x.x.x.113: S
> > 3099755125:3099755125(0) win 16384 <mss 1460> (DF)
> > 22:06:02.668756 128.121.116.162.4479 > x.x.x.x.113: S
> > 3099755125:3099755125(0) win 16384 <mss 1460> (DF)
> > 22:06:05.668668 128.121.116.162.4479 > x.x.x.x.113: S
> > 3099755125:3099755125(0) win 16384 <mss 1460> (DF)

>



 
Reply With Quote
 
Tommy
Guest
Posts: n/a
 
      10-17-2003
reshman wrote:

> FreeBSD 5.1
>
> "Tommy" <(E-Mail Removed)> wrote in message
> news:1911390.QYd4ZJqnt5@FreeBSD...
>> reshman wrote:
>>
>> > Anyone have any ideas why I would be seeing hits directed to my on port
>> > 113 -- all around the same time? Would this have anything to do with
>> > doing a make for a port out of the ports package???
>> >
>> > Thanks!
>> >
>> > -Mike

>>


It sounds like scalper. Have you went to ports and installed 'chkrootkit?'
If not, install it and run it. and see what comes up with.
 
Reply With Quote
 
reshman
Guest
Posts: n/a
 
      10-17-2003
chkrootkit didn't find anything.

what is scalper?

-Mike

"Tommy" <(E-Mail Removed)> wrote in message
news:1848528.XzRNta5OcC@FreeBSD...
> reshman wrote:
>
> > FreeBSD 5.1
> >
> > "Tommy" <(E-Mail Removed)> wrote in message
> > news:1911390.QYd4ZJqnt5@FreeBSD...
> >> reshman wrote:
> >>
> >> > Anyone have any ideas why I would be seeing hits directed to my on

port
> >> > 113 -- all around the same time? Would this have anything to do with
> >> > doing a make for a port out of the ports package???
> >> >
> >> > Thanks!
> >> >
> >> > -Mike
> >>

>
> It sounds like scalper. Have you went to ports and installed 'chkrootkit?'
> If not, install it and run it. and see what comes up with.



 
Reply With Quote
 
Tommy
Guest
Posts: n/a
 
      10-17-2003
reshman wrote:

> chkrootkit didn't find anything.
>
> what is scalper?
>
> -Mike

================================================== ==========
This worm uses the Apache HTTP Server chunk encoding stack overflow
vulnerability to spread itself. Currently it has only been confirmed that
this worm works on the FreeBSD platform. FreeBSD is an advanced operating
system for Intel ia32 compatible, DEC Alpha, and PC-98 architectures. It is
derived from BSD UNIX, the version of UNIX developed at the University of
California, Berkeley. It is developed and maintained by a large team of
individuals.

This worm has received some media coverage but we believe it is currently
not prevalent in the wild. So far, we have not received any customer
reports of this worm. For information regarding the vulnerability, please

You can read more about it below.
http://securityresponse.symantec.com...lper.worm.html
================================================== =======

I connected to an infected Apache server and got hit with it. The server
will start pinging your computer...You may want to run snort and catch a
few packets and see if you get anything from whitehats.com

This is a message from www.whitehats.com
Seeing Cyberkit Ping probes to your network? Great it's a new worm. All I
ask is that you please learn to read your IDS headers and understand which
part is the source address versus the information URL. The part that says
whitehats.com? That is the information URL not the source! Thanks

The only other known security issues I know of in BSD are sendmail and
SSH......If you are using SSH & sendmail make sure you patch them........If
you're not using them disable them from root/rc/config
 
Reply With Quote
 
Don Kelloway
Guest
Posts: n/a
 
      10-18-2003
"reshman" <marjunk*NO-SPAM*@charter.net> wrote in message
news:(E-Mail Removed)...
> Anyone have any ideas why I would be seeing hits directed to my on

port
> 113 -- all around the same time? Would this have anything to do with

doing
> a make for a port out of the ports package???
>
> Thanks!
>
> -Mike
>


What is TCP port 113? As stated by several others TCP port 113 is used
to support the Identification/Authentication protocol. Such may be used
by the server you are attempting to connect to when you are attempting
to connect to the server with either the SMTP, FTP, or IRC protocols.

Why do servers use IDENT/AUTH? As stated above the purpose of using
IDENT/AUTH is that the server you are attempting to connect to, would in
turn attempt to connect to your IP address on TCP port 113 before
allowing you to start the process of transmitting data. If you are/were
hosting an IDENT/AUTH server, information such as your hostname is
passed to the other server. The server in turn would use this
information to identify or authenticate your system and then allow your
system to initiate the sending of the data.

Is IDENT/AUTH mandatory? No, it's not mandatory. Years ago when the
Internet was still in it's infancy, IDENT/AUTH was commonly used, but as
time passed and the Internet exploded in growth. It became less and
less used and as a result many servers will still allow you to connect
even if you don't host an IDENT/AUTH server. It just results in slowing
down the process by a few seconds.


--
Best regards,
Don Kelloway
Commodon Communications

Visit http://www.commodon.com to learn about the "Threats to Your
Security on the Internet".


 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Flextel attempting to hack customers on port 113 from217.40.239.104 Flying Pigs UK VOIP 6 02-14-2011 05:55 AM
Number of hits divided by "robot hits" Dos-Man HTML 5 03-04-2004 07:56 AM
c1600-y-l.113-5.T SPS Cisco 4 02-24-2004 06:46 PM
trying to stealth port 113 RadarG Computer Security 2 12-10-2003 07:40 PM
OT: Port 113 picayunish HTML 28 10-13-2003 11:35 PM



Advertisments