Simply put.... port 119 is the reserved port for NNTP servers. Newsgroups if you will. More than likely, its just people looking for open news servers to post on.
Chris Patterson Network Administrator Axiom Systems Http://Www.AxiomSys.Com The Truth Is Out There. Go Find It. Http://Www.2600.Com -----Original Message----- From: Antti Tolamo [mailto:[EMAIL PROTECTED]] Sent: Tuesday, October 16, 2001 1:06 PM To: [EMAIL PROTECTED] Subject: Port 119 scans This is my first post in list and I'm sorry if my post feels bit trivial. I'm not ISP, or hold a large network or LAN, just a person who has fixed IP with a Linux server. I use ipchains as a firewall and have small LAN with Windows clients. As it happens, I get majority of scans directed to me at port 119. And I can't understand why. I know it is not dangerous, but it really has start to bug me because it is continious. I don't think it is normal. How much scans to port 119 people who read this get proportinally to other scans? As a note, I've kept about year a server now, I don't get scared or annoyed if I'm just scanned a lot like some total newbie could. Sources vary. But most of them come, by looking domain names, from domain addresses that allocated through DHCP. No special country or place I could pinpoint however. So they are propably people who use ISP accounts and thus high propability they are script kiddies. Any ideas why I should get lot of scans to port 119? About month or two I've been getting these scans. Thanks in advance for any input. Antti _______________________________________________ Firewalls mailing list [EMAIL PROTECTED] http://lists.gnac.net/mailman/listinfo/firewalls _______________________________________________ Firewalls mailing list [EMAIL PROTECTED] http://lists.gnac.net/mailman/listinfo/firewalls
