I dont know much about port 20480, but 6667 is an attempt to connect to a mIRC Server.
I dont know if 192.168.0.199 is a router IP or a pc, but if its a pc, check to see if that pc has any IRC Server Software is installed. (6667) is default port for a irc server.// Just my 2 cents Good Luck~ DS- ----- Original Message ----- From: "Kip Sr." <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, October 10, 2002 3:16 PM Subject: Increase in traffic on port 20480 and 6667 > Hi there, > > In the past few days, my IDS has been picking up > traffic coming from port 20480 (on Internet servers) > to port 6667 (internal desktops). Both ports are > commonly used by trojan horse programs. Has anyone > else seens this? > > 10/10-11:50:01.977897 204.x.x.x:20480 -> > 192.168.0.199:6667 > TCP TTL:255 TOS:0x10 ID:0 IpLen:20 DgmLen:195 > > > Thanks, > Kip Sr. > > __________________________________________________ > Do you Yahoo!? > Faith Hill - Exclusive Performances, Videos & More > http://faith.yahoo.com
