[Dshield] Port 6129 (DameWare) and 3643 (audiojuggler) Scans

Jon R. Kibler Jon.Kibler at aset.com
Sun Jan 18 20:05:07 GMT 2004


Anyone know why the big jump in port 6129/tcp scans? 

They seem to be originating for a wide variety of DSL and cable connections. 

Yesterday, the number of scans increased to the point that, for us, they were only exceeded by the number scans for 135/tcp and 80/tcp. For DShield, it appears to be about #6 or #7 in frequency of scans.

Also, we have seen a jump in scans to port 3643/tcp. This started Tuesday with a few probes from Europe and then seemed to move to Asia towards the end of the week, and yesterday we had one U.S. cable modem user hit us about 4 dozen times, then it appears to have stopped. For DShield, this port isn't even on the map, but it was in our top 10 yesterday and top 25 most of last week.

We have gotten rid of all but 2 or 3 Windows boxes (which are clean), and definitely do not run either of the apps associated with these ports on any *NIX box. Any ideas what these scans may be about?


Jon R. Kibler
Chief Technical Officer
A.S.E.T., Inc.
Charleston, SC  USA
(843) 849-8214

Filtered by: TRUSTEM.COM's Email Filtering Service
No Spam. No Viruses. Just Good Clean Email.

More information about the list mailing list