Port 1840 Scans

Hi guys

Has anyone else seen any high rate of port scans on 1840/UDP/TCP

I get a ridiculous amount of these per day from many different networks.
According to IANA netopia-vo2 has this port registered, (along with many
other trojans)

Does anyone have any info on these port scans please

Maybe I should analyse the payload ?

Steve-O

Steve-O <> wrote:
> Has anyone else seen any high rate of port scans on 1840/UDP/TCP
>
> I get a ridiculous amount of these per day from many different networks.
> According to IANA netopia-vo2 has this port registered, (along with many
> other trojans)
>
> Does anyone have any info on these port scans please
>
> Maybe I should analyse the payload ?

Not on your particular pattern but it's a good idea to check:

http://isc.sans.org/
http://aris.securityfocus.com/ (registration required)

And to a certain extent:

http://securityresponse.symantec.com/

I don't see any 1840/* issues in any of my logs.

Cheers, -Ali

--
OpenPGP Key: 030E44E6
--
Was I helpful?: http://svcs.affero.net/rm.php?r=packetknife
--
How can we lose when we're so sincere?! -- Charlie Brown

Ali-Reza Anghaie

"Steve-O" <> wrote in message
news:yd31c.4$54.3@newsfe1-win...
> Hi guys
>
> Has anyone else seen any high rate of port scans on 1840/UDP/TCP
>
> I get a ridiculous amount of these per day from many different networks.
> According to IANA netopia-vo2 has this port registered, (along with many
> other trojans)
>
> Does anyone have any info on these port scans please
>
> Maybe I should analyse the payload ?
>
>
>
Port 1840 is used by an application called netopia-vo2. It's possible that
like for example PC anywhere, servers scan the local subnet for other copies
of themselves. That's one possibility. I don't know of any Trojans which use
this port; that's what I would say for ports 12345 or 17300, for example.
These are used by netbus and Kuang2 respectively. I see a lot of probes for
these.
DN

David Norris