[unisog] echo and chargen

H. Morrow Long morrow.long at yale.edu
Tue Jan 21 21:49:10 GMT 2003


I've noticed KaZaa and some other P2P programs
picking a number of different ports at which
to reside and listen these days (E.g. to get
around port blocking and confuse bandwidth
management solutions).  Perhaps KaZaa is picking
the echo and chargen ports on student PC
some times.

H. Morrow Long
University Information Security Officer
Yale University, ITS, Dir. InfoSec Office


Mary M. Chaddock wrote:
> The machines with the ports open are student's computers located in their 
> dorms.  These are machines that did not have these ports open last month. 
> There are quite a few of them. My firewall logs show there were several 
> incoming connections _from_ port 7 on a udavis.edu computer. However, 
> again, that is only one of many. There is a payload, and this does not 
> appear to be a DoS.
> 
> I'm suspecting P2P is involved somehow.
> 
> Thanks,
> -Mary.
> 
> Mary M. Chaddock, GSEC, GCUX
> Network Security Administrator




More information about the unisog mailing list