>From http://www.robertgraham.com/pubs/firewall-seen.html,
Ports 32770-32900 are typically used for Sun RPC services:
"Sun Solaris puts most of its RPC services in this range. In particular,
older versions of Solaris (pre-2.5.1) put a portmapper in this range,
allowing hackers access to this even when low ports are blocked by a
firewall. Probes in this range might either be for this portmapper, or
for known RPC services that can be exploited. "
HTH,
Jason
Marco Ludwig wrote:
>
> Hello everybody,
>
> does anybody known what is service 32790 ???
>
> I have a lot of rejects in the log viewer e.g.
>
> src: clientxy
> dst: firewall (LAN-interface)
> svc: 32790
> proto: tcp
> src-port: dynamic (1100-2700)
> rule: 0
> info: message syn defender warning: SYN -> SYN-ACK -> RST or
> message syn defender warning: SYN -> SYN-ACK -> Timeout
>
> SNMP is not active on the firewall. Sometimes the same message with
> port 32789 or 32792. All clients are WinNT 4.0 Workstations.
>
> thx.
>
> --
> Best regards,
> Marco mailto:[EMAIL PROTECTED]
>
> ================================================================================
> To unsubscribe from this mailing list, please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> ================================================================================
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
