Port 3509?

When I use Tinylogger to view my Kerio log, I notice that this morning
I'm getting a lot of TCP packets sent to port 3509 on my system. This
is right after I boot up and before I start any programs (browsers,
news reader, mail etc.) They're coming in groups of three and all
getting blocked, but I'm still curious what this is all about. Anybody
help here?

TIA

--
Regards from John Corliss

John Corliss

"John Corliss" <#> wrote in message
news:...
> I'm getting a lot of TCP packets sent to port 3509 on my system.

Virtual Token SSL port.

Ref: http://www.seifried.org/security/ports/3000/3509.html

PT Wang

PT Wang wrote:
> John Corliss wrote:
>
>> I'm getting a lot of TCP packets sent to port 3509 on my system.
>
> Virtual Token SSL port.
>
> Ref: http://www.seifried.org/security/ports/3000/3509.html

Thanks for the pointer. However, now I'm dealing with an undefined
(from my perspective) terminology.

Virtual Token SSL Port = Virtual Token Secure Sockets Layer Port.

Virtual = "Being such in essence or effect though not in actual fact"
Token = "An individual instance of a type of symbol"

Can you explain why I'm getting so many hits on that port? Is there a
virus that's hitting this one like the MSBlast virus was hitting the
135 port?

Again, TIA.

--
Regards from John Corliss
No adware, cdware, commercial software, crippleware, demoware,
nagware, shareware, spyware, time-limited software, trialware, viruses
or warez please.

John Corliss

http://www.dshield.org/port_report.php?port=3509

http://isc.sans.org/port_details.html?port=3509

Dave



"John Corliss" <#> wrote in message
news:...
| When I use Tinylogger to view my Kerio log, I notice that this morning
| I'm getting a lot of TCP packets sent to port 3509 on my system. This
| is right after I boot up and before I start any programs (browsers,
| news reader, mail etc.) They're coming in groups of three and all
| getting blocked, but I'm still curious what this is all about. Anybody
| help here?
|
| TIA
|
| --
| Regards from John Corliss
|

David H. Lipman

"John Corliss" <#> wrote in message
news:...
> Can you explain why I'm getting so many hits on that port? Is there a
> virus that's hitting this one like the MSBlast virus was hitting the
> 135 port?

Possibly. Do you have a fixed IP?

Which IPs do the probes originate? Do they come from your own subnet?

PT Wang

John Corliss <#> wrote in message news:<>...
> When I use Tinylogger to view my Kerio log, I notice that this morning
> I'm getting a lot of TCP packets sent to port 3509 on my system. This
> is right after I boot up and before I start any programs (browsers,
> news reader, mail etc.) They're coming in groups of three and all
> getting blocked, but I'm still curious what this is all about. Anybody
> help here?
>
> TIA


That would be Virtual Token SSL (Secure Socket Layer) port, but
couldn't say why your getting it, probably just normal Internet
garbage traffic.

~oog

ooogla

PT Wang wrote:

> "John Corliss" <#> wrote in message
> news:...
>
>>Can you explain why I'm getting so many hits on that port? Is there a
>>virus that's hitting this one like the MSBlast virus was hitting the
>>135 port?
>
>
> Possibly. Do you have a fixed IP?

No.

> Which IPs do the probes originate? Do they come from your own subnet?

Not from my subnet. From lots of other places. However, the activity
seems to have stopped. This afternoon, I uninstalled Client for
Microsoft Networks for another reason. That made Netstat -a show two
less active UDP connections. Wonder if this had anything to do with it
(doubtful.)

--
Regards from John Corliss

John Corliss

ooogla wrote:
> John Corliss wrote:
>
>>When I use Tinylogger to view my Kerio log, I notice that this morning
>>I'm getting a lot of TCP packets sent to port 3509 on my system. This
>>is right after I boot up and before I start any programs (browsers,
>>news reader, mail etc.) They're coming in groups of three and all
>>getting blocked, but I'm still curious what this is all about. Anybody
>>help here?
>>
>>TIA
>
> That would be Virtual Token SSL (Secure Socket Layer) port, but
> couldn't say why your getting it, probably just normal Internet
> garbage traffic.

It seems to have stopped for the time being. As I mentioned to PT
Wang- this afternoon, I uninstalled Client for Microsoft Networks for
another reason. That made Netstat -a show two less active UDP
connections. Wonder if this had anything to do with it (doubtful.)

--
Regards from John Corliss

John Corliss

David H. Lipman wrote:
> John Corliss wrote:
>> When I use Tinylogger to view my Kerio log, I notice that this morning
>> I'm getting a lot of TCP packets sent to port 3509 on my system. This
>> is right after I boot up and before I start any programs (browsers,
>> news reader, mail etc.) They're coming in groups of three and all
>> getting blocked, but I'm still curious what this is all about. Anybody
>> help here?
>
> http://www.dshield.org/port_report.php?port=3509
> http://isc.sans.org/port_details.html?port=3509

Thanks for the links, Dave. I've bookmarked the following:

http://www.dshield.org/

Lots of good stuff there.

--
Regards from John Corliss

John Corliss

Is there any way to add a port onto the list?

I'm writing a Half-Life mod that uses a different port than the standard
Half-Life port (27015) and don't want people blocking it (would break the
program); so adding a port onto the list might make people not block it.

*tongue-tied*

"John Corliss" <#> wrote in message
news:...
> ooogla wrote:
> > John Corliss wrote:
> >
> >>When I use Tinylogger to view my Kerio log, I notice that this morning
> >>I'm getting a lot of TCP packets sent to port 3509 on my system. This
> >>is right after I boot up and before I start any programs (browsers,
> >>news reader, mail etc.) They're coming in groups of three and all
> >>getting blocked, but I'm still curious what this is all about. Anybody
> >>help here?
> >>
> >>TIA
> >
> > That would be Virtual Token SSL (Secure Socket Layer) port, but
> > couldn't say why your getting it, probably just normal Internet
> > garbage traffic.
>
> It seems to have stopped for the time being. As I mentioned to PT
> Wang- this afternoon, I uninstalled Client for Microsoft Networks for
> another reason. That made Netstat -a show two less active UDP
> connections. Wonder if this had anything to do with it (doubtful.)
>
> --
> Regards from John Corliss
>

Alan P