[unisog] Windows 2000 break-ins

Bill Smith smithwh at wfu.edu
Fri Sep 6 18:33:48 GMT 2002


Here is a list of IRC ports:

irc             194/tcp    Internet Relay Chat Protocol        
irc             194/udp    Internet Relay Chat Protocol
irc-serv        529/tcp    IRC-SERV
irc-serv        529/udp    IRC-SERV
ircs		    994/tcp    irc protocol over TLS/SSL
ircs		    994/udp    irc protocol over TLS/SSL
ircu		    6665-6669/tcp  IRCU
ircu		    6665-6669/udp  IRCU

Most of the hits we see are 6666, 6667 and 6668 but I have seen hits on
all. Hope this help and good luck.

Bill Smith
Network Engineer
Wake Forest University
smithwh at wfu.edu
phone:  336-758-3962
mobile: 336-391-3010

-----Original Message-----
From: Robert Dormer [mailto:rdormer at pobox.upenn.edu] 
Sent: Friday, September 06, 2002 12:37 PM
To: Chris Wilson
Cc: unisog at sans.org
Subject: Re: [unisog] Windows 2000 break-ins

At 09:23 AM 9/6/2002 -0400, you wrote:
>A quick question reguarding XDCC traffic. What port(s) are typicaly
>for XDCC

IRC connections typically use port 6666, and ports close to that number.

Robert Dormer

Information Security - University of Pennsylvania
phone: (215) 573 - 4574
email: rdormer at isc.upenn.edu
security: security at isc.upenn.edu

More information about the unisog mailing list