On Sat, Aug 03, 2002 at 11:00:36PM +0200, Arne Schwabe wrote: > Hi, > > today i saw lot of connection attemps to port 12980 on my > machine. Because that are many[1] and they came from different hosts i > am wondering what is going on here. > > Arne > > [1] > [EMAIL PROTECTED]/var/log$ grep "Aug 3" kern.log | grep 12980 | wc -l > 628 > This questions are starting to become somewhat of a FAQ. My answer is, if you do not know what port is related to an attack you are receiving it might be worth checking:
- To see which ports are actively being probed/attack: http://isc.incidents.org/ or http://www.dshield.org/ (https://analyzer.securityfocus.com/ seems to have had this info previously but does not seem to make it public anymore). More specifically: http://isc.incidents.org/top10.html - To see what service might be associated to a given port check http://www.portsdb.org/ Unfortunately a search in any of these regarding 12980 didn't return a thing so you might want to report it to ISC. Regards Javi