[Dshield] PORT 22321

Simon Waters Simon at wretched.demon.co.uk
Tue Sep 30 11:10:12 GMT 2003


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Came across a remote server apparently cracked with this port listening.

Not sure it has any significance or not, but when I pulled up the
dshield 70 day log for this port it has a pretty distinctive shape.

Big peak, followed by little peak 2 days later, there are two of these
in the 70 day view.

Does anyone know why?

My immediate thought was it is some sort of search engine, or similar,
but the number of sources and targets increases, almost like peer to
peer or distributed network activity.

As far as I know it is supposed allocated to some sort of oriental
character input software, 22321 supporting Taiwanese (which seems very
unlikely in the country his server is located), but I don't know much
about WNN, and most of the explanations seem to be in Japansese.

 Very curious,

 Simon
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQE/eWSSGFXfHI9FVgYRAsUVAJ9oFaM1mIpbgPsTN02IhwXtc0UUhgCfQvKg
cK3e6gpR7fF2zNGcn7DXSq8=
=dxsN
-----END PGP SIGNATURE-----




More information about the list mailing list