[Dshield] PORT 22321

Deb Hale haled at pionet.net
Tue Sep 30 14:20:34 GMT 2003


Page 44 of this article talks about this port being used by a Korean Music
Service.  Maybe someone was looking for KaZaa like sites and happened across
this. 

http://www.giac.org/practical/GCIA/Michael_Wisener_GCIA.pdf



Simon said:

Came across a remote server apparently cracked with this port listening.

Not sure it has any significance or not, but when I pulled up the dshield 70
day log for this port it has a pretty distinctive shape.

Big peak, followed by little peak 2 days later, there are two of these in
the 70 day view.

Does anyone know why?

My immediate thought was it is some sort of search engine, or similar, but
the number of sources and targets increases, almost like peer to peer or
distributed network activity.

As far as I know it is supposed allocated to some sort of oriental character
input software, 22321 supporting Taiwanese (which seems very unlikely in the
country his server is located), but I don't know much about WNN, and most of
the explanations seem to be in Japansese.

 Very curious,

 Simon





More information about the list mailing list