20480 is also commonly used by some multiplayer games for their server
ports also.
-Original Message-
From: KoRe MeLtDoWn [mailto:koremeltdown;hotmail.com]
Sent: Tuesday, October 15, 2002 11:43 PM
To: [EMAIL PROTECTED]; [EMAIL PROTECTED]
Subject: Re: Increase in traffic on port 20480 and
KoRe MeLtDoWn wrote:
Be informed that 6667 is also one of the most common ports for IRC
servers to run on
From: Kip Sr. [EMAIL PROTECTED]
to port 6667 (internal desktops). Both ports are
commonly used by trojan horse programs. Has anyone
Both right, and more: lots of trojans (zombies,
Be informed that 6667 is also one of the most common ports for IRC servers
to run on
Hamish Stanaway
-= KoRe WoRkS =- Internet Security
Owner/Operator
http://www.koreworks.com/
New Zealand
Is your box REALLY secure?
From: Kip Sr. [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject:
Not a mIRC server, but IRC servers in general. There are other clients than
mIRC, such as PIRCH, vIRC, BitchX, etc.
Pez Mohr
[EMAIL PROTECTED]
Aspiring BOFH
- Original Message -
From: dsardina [EMAIL PROTECTED]
To: Kip Sr. [EMAIL PROTECTED]; [EMAIL PROTECTED]
Sent: Tuesday, October 15,
port -6668 is also used by APC UPS software to manage the UPS. This
drove me nuts until I found out :)
But your actually seeing traffic.. So my best guess is that this is IRC
related. Which doesn't mean it's not a virus or trojan! Many DDOS programs
use irc for controlling the zombies. Clean
If it is a Windows machine use fport to see what EXE is opening the
port. If it is Unix the lsof will do the same job.
http://www.foundstone.com/knowledge/intrusion_detection.html
Note the port and file monitors which might be useful in your
investigation?!?
http://freshmeat.net/projects/lsof
I dont know much about port 20480, but 6667 is an attempt to connect to a
mIRC Server.
I dont know if 192.168.0.199 is a router IP or a pc, but if its a pc,
check to see if that pc has any IRC Server Software is installed.
(6667) is default port for a irc server.//
Just my 2 cents
Good Luck~
