Ports to watch

Here's a list of some port numbers that you should watch carefully. They are often associated with lax security and security breaches.

So you've set up your analyzer to gather a gazillion packets and give you some clue about which applications are

running on your network... uh... ok. What next?

The following provides a list of some port numbers that you should watch carefully. They are often associated with lax security and security breaches.

Identify the systems that are using these ports. If the application is a trusted, well-behaved application that should be loaded on that system, breathe a sigh of relief. If, however, the application is unnecessary or poorly behaved -- dump it!

  • 7 echo
  • 19 chargen
  • 20 FTP data
  • 21 FTP connection
  • 22 ssh
  • 23 telnet
  • 25 SMTP
  • 37 time
  • 53 domain
  • 110 POP3
  • 111 SUNRPC
  • 666 hack favorite
  • 999 Winsatan
  • 27444 Trinoo
  • 27665 Trinoo
  • 31335 Trinoo
  • 31337 Back Orifice

Don't forget to check for any packets that are illogical in their structure. For example, packets sent to the NetBIOS-SSN port (139) with the Urgent flag set in the TCP header just doesn't make sense. This may cause an unpatched, older version of windows to belly-up and die -- this type of attack is called WinNuke or OOBNuke (out of bounds nuke).

For more security info, you can order Laura's "Security at the Packet Level" course or attend one of her seminars in person. Click here to find out more.

Also register to see Laura speak at Networking Decisions 2004.


Laura Chappell is the Senior Protocol Analyst for the Protocol Analysis Institute. She is the author of numerous books and self-paced courseware available online at www.packet-level.com and www.podbooks.com. Laura also lectures on analysis, optimization and cybercrime. Her course schedule is online at www.packet-level.com.
This was first published in March 2004

Dig deeper on Network Administration

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchSDN

SearchEnterpriseWAN

SearchUnifiedCommunications

SearchMobileComputing

SearchDataCenter

SearchITChannel

Close