[unisog] Windows 2000 break-ins

Bill Smith smithwh at wfu.edu
Fri Sep 6 18:33:48 GMT 2002


Robert,

Here is a list of IRC ports:

irc             194/tcp    Internet Relay Chat Protocol        
irc             194/udp    Internet Relay Chat Protocol
irc-serv        529/tcp    IRC-SERV
irc-serv        529/udp    IRC-SERV
ircs		    994/tcp    irc protocol over TLS/SSL
ircs		    994/udp    irc protocol over TLS/SSL
ircu		    6665-6669/tcp  IRCU
ircu		    6665-6669/udp  IRCU

Most of the hits we see are 6666, 6667 and 6668 but I have seen hits on
all. Hope this help and good luck.

Bill Smith
Network Engineer
Wake Forest University
smithwh at wfu.edu
phone:  336-758-3962
mobile: 336-391-3010
 

-----Original Message-----
From: Robert Dormer [mailto:rdormer at pobox.upenn.edu] 
Sent: Friday, September 06, 2002 12:37 PM
To: Chris Wilson
Cc: unisog at sans.org
Subject: Re: [unisog] Windows 2000 break-ins

At 09:23 AM 9/6/2002 -0400, you wrote:
>A quick question reguarding XDCC traffic. What port(s) are typicaly
used 
>for XDCC


IRC connections typically use port 6666, and ports close to that number.


Regards,
Robert Dormer

=============
Information Security - University of Pennsylvania
phone: (215) 573 - 4574
email: rdormer at isc.upenn.edu
security: security at isc.upenn.edu







More information about the unisog mailing list