TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
We have seen them here as well, they seem to be looking for Red Hat Linux
ver. 6.*.* .
Do you have a line on the Source address?
Vern Waltman
LIWA/ACERT\CC\CDAP
Litton TASC
(703) 706-1224
-----Original Message-----
From: Joe Matusiewicz [mailto:[EMAIL PROTECTED]]
Sent: Friday, October 06, 2000 9:51 AM
To: netboss; ISS Mailing List; fw1-wizards
Subject: Re: [fw1-wizards] TCP port 9704 anyone?
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------
I've seen three of these in the past week. It seems to be the port used for
a backdoor installed by an rpc.statd exploit, the name of which escapes me
right now. Someone is looking for hosts that respond on this odd port to
see if they've been r00ted.
* Joe
At 03:14 PM 10/5/00, netboss wrote:
>My network was recently IPHalfScanned for TCP port 9704. My faithful
>references at
>
>http://www.isi.edu/in-notes/iana/assignments/port-numbers
>http://www.onctek.com/trojanports.html
>http://www.simovits.com/nyheter9902.html
>http://www.tla.ch/TLA/NEWS/1999sec/19990517trojan.htm
>
>left me empty handed. Does anyone have any idea what tcp 9704 is used for?
>
>Thanks in advance.
>
>______________________________________________
>FREE Personalized Email at Mail.com
>Sign up at http://www.mail.com/?sr=signup
>
>
>---------------------------------------------------------------------
>This email came from the FireWall-1 Wizards Mailing List
>To unsubscribe, e-mail: [EMAIL PROTECTED]
>For more information, email: [EMAIL PROTECTED]
