The following provides a list of some port numbers that you should watch carefully. They are often associated with lax security and security breaches.
Identify the systems that are using these ports. If the application is a trusted, well-behaved application that should be loaded on that system, breathe a sigh of relief. If, however, the application is unnecessary or poorly behaved -- dump it!
- 7 echo
- 19 chargen
- 20 FTP data
- 21 FTP connection
- 22 ssh
- 23 telnet
- 25 SMTP
- 37 time
- 53 domain
- 110 POP3
- 111 SUNRPC
- 666 hack favorite
- 999 Winsatan
- 27444 Trinoo
- 27665 Trinoo
- 31335 Trinoo
- 31337 Back Orifice
Don't forget to check for any packets that are illogical in their structure. For example, packets sent to the NetBIOS-SSN port (139) with the Urgent flag set in the TCP header just doesn't make sense. This may cause an unpatched, older version of windows to belly-up and die -- this type of attack is called WinNuke or OOBNuke (out of bounds nuke).
For more security info, you can order Laura's "Security at the Packet Level" course or attend one of her seminars in person.
Requires Free Membership to View
Click here to find out more.
Also register to see Laura speak at Networking Decisions 2004.
Laura Chappell is the Senior Protocol Analyst for the Protocol Analysis Institute. She is the author of numerous books and self-paced courseware available online at www.packet-level.com and www.podbooks.com. Laura also lectures on analysis, optimization and cybercrime. Her course schedule is online at www.packet-level.com.
This was first published in March 2004