Re: [FW-1] Firewall logs

[subscriptions@FW1-NOSPAMDFCCBANK.COM]

Thanks Don

1.
I found the kpop searching through google. if any one is interested, it is
said

"KPOP is a kerberized POP3 proxy for UNIX and Windows. The idea is simple:
user connects to the proxy on localhost, and then the proxy connects to
the real server and uses the users' KDBTGT to authenticate. "

So i will try to dig in to my firewall config and see why it was trying to
use this. The only thing is I dont know how firewall logged the port as
"kpop" as it is not listed in the services. I suppose may be there are
services which the fw doesnt show to the user in that dialog box.

2.
port 1040 is not  extremely important but I an just curious as to why
everybody in the internet (which is trying to connecting in to my fw) is
trying this specific port. There may be some vulnerability associated with
this port.

well if I find anything i will post it .

Thanks





Don <don@BLACKSUN.ORG>
Sent by: Mailing list for discussion of Firewall-1
<FW-1-MAILINGLIST@beethoven.us.checkpoint.com>
22/02/2002 12:14
Please respond to Mailing list for discussion of Firewall-1


        To:     FW-1-MAILINGLIST@beethoven.us.checkpoint.com
        cc:
        Subject:        Re: [FW-1] Firewall logs


> 1. What is "kpop" service?. I am seeing this in my fw log. This is not a
> service I have defined and I cant find it in any documentation. This has
> to relate to mail as the destination server I see is a new Zealand (.nz)
> mail server
Check /etc/services on your system (if it is Unix) to see what kpop is
listed as.

> 2. What service generally run on port 1040? . A lot of machines  seems
to
> trying to connect to this port of the firewall. This seems to be the
most
> popular port after the port 80. I couldn't find a service running on
this
> port on well known ports document.
Almost any service could operate on port 1040. I am not aware of any
particular service assigned to port 1040 though you could certainly search
for it.

-Don

===

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================