Ports to watch

Laura Chappell, Senior Protocol Analyst, Protocol Analysis Institute
So you've set up your analyzer to gather a gazillion packets and give you some clue about which applications are running on your network... uh... ok. What next?

The following provides a list of some port numbers that you should watch carefully. They are often associated with lax security and security breaches.

Identify the systems that are using these ports. If the application is a trusted, well-behaved application that should be loaded on that system, breathe a sigh of relief. If, however, the application is unnecessary or poorly behaved -- dump it!

  • 7 echo
  • 19 chargen
  • 20 FTP data
  • 21 FTP connection
  • 22 ssh
  • 23 telnet
  • 25 SMTP
  • 37 time
  • 53 domain
  • 110 POP3
  • 111 SUNRPC
  • 666 hack favorite
  • 999 Winsatan
  • 27444 Trinoo
  • 27665 Trinoo
  • 31335 Trinoo
  • 31337 Back Orifice

Don't forget to check for any packets that are illogical in their structure. For example, packets sent to the NetBIOS-SSN port (139) with the Urgent flag set in the TCP header just doesn't make sense. This may cause an unpatched, older version of windows to belly-up and die -- this type of attack is called WinNuke or OOBNuke (out of bounds nuke).

For more security info, you can order Laura's "Security at the Packet Level" course or attend one of her seminars in person.

    Requires Free Membership to View

Click here to find out more.

Also register to see Laura speak at Networking Decisions 2004.

Laura Chappell is the Senior Protocol Analyst for the Protocol Analysis Institute. She is the author of numerous books and self-paced courseware available online at www.packet-level.com and www.podbooks.com. Laura also lectures on analysis, optimization and cybercrime. Her course schedule is online at www.packet-level.com.

This was first published in March 2004

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.