Re: [FW1] port 32790

[Jason Witty <jason@FW1-NOSPAMwittys.com>]

>From http://www.robertgraham.com/pubs/firewall-seen.html, 

Ports 32770-32900 are typically used for Sun RPC services:

"Sun Solaris puts most of its RPC services in this range. In particular,
older versions of Solaris (pre-2.5.1) put a portmapper in this range,
allowing hackers access to this even when low ports are blocked by a
firewall. Probes in this range might either be for this portmapper, or
for known RPC services that can be exploited. "

HTH,

Jason

Marco Ludwig wrote:
> 
> Hello everybody,
> 
>   does anybody known what is service 32790 ???
> 
>   I have a lot of rejects in the log viewer e.g.
> 
>   src: clientxy
>   dst: firewall (LAN-interface)
>   svc: 32790
>   proto: tcp
>   src-port: dynamic (1100-2700)
>   rule: 0
>   info: message syn defender warning: SYN -> SYN-ACK -> RST or
>         message syn defender warning: SYN -> SYN-ACK -> Timeout
> 
>   SNMP is not active on the firewall. Sometimes the same message with
>   port 32789 or 32792. All clients are WinNT 4.0 Workstations.
> 
>   thx.
> 
> --
> Best regards,
>  Marco                          mailto:FWAdmin@binss.net
> 
> ================================================================================
>      To unsubscribe from this mailing list, please see the instructions at
>                http://www.checkpoint.com/services/mailing.html
> ================================================================================


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================