[Dshield] Possible problem?

Dom De Vitto dom at devitto.com
Wed Mar 9 19:28:20 GMT 2005


These are all ports commonly blocked by ISPs, like NTL do in the UK.

Dom De VItto

-----Original Message-----
From: list-bounces at lists.dshield.org [mailto:list-bounces at lists.dshield.org]
On Behalf Of Paul Marsh
Sent: 07 March 2005 20:18
To: list at lists.dshield.org
Subject: [Dshield] Possible problem?

I did a nmap scan on one of my users home systems.  Its a typical
broadband connection default TCP scan revealed port 21, 25 and 80 open.
In the past I've found that these ports belong to the broadband modem.
I then did a -sU default UDP and found the following:

PORT     STATE    SERVICE
135/udp  filtered msrpc
136/udp  filtered profile
138/udp  filtered netbios-dgm
1434/udp filtered ms-sql-m

135-138 typical MS stuff no?

1434 I know the user is not running SQL monitor.  Is it likely the
system has SQL slammer/Sapphire running on it?

The system is XP home SP2

Thanx, Paul

-------------- Sponsor Message ------------------------------------
SANS Intrusion Immersion Training: Orlando, FL, February 3-9th
http://www.sans.org/orlando05

_______________________________________________
send all posts to list at lists.dshield.org
To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list





More information about the list mailing list