Arcserve using IRC Ports?

[PaulW1977]

I received the following entries in my McAfee virus scanner logs this morning:

6/21/2005 2:06:25 AM Blocked by port blocking rule cadiscovd.exe Prevent IRC communication 127.0.0.1
6/21/2005 2:06:26 AM Blocked by port blocking rule Catirpc.exe Prevent IRC communication 127.0.0.1

One of my Remote Backups failed about an hour later with the message "Failed to connect to client agent"

I do not know if these are related but...

I've done a complete virus scan of both systems and found nothing. Virus scanners are up to date (VS Enterprise 8.0i with the June 21 DAT).

Does Arcserve use any ports that McAfee might beleive are IRC ports? Any other ideas?

 

[speshalyst]

HI,

ARCserve does use several TCP/UDP ports .
What are the ports that McAfee pulls up ?

As far the problem on hand.. could be due to something completely different.
Please investigate further.

So it Shall be Written!
So it Shall be Done!!

 

[vschumpy]

netstat -an will tell you what processes are using what ports.

Catirpc is the portmapper and cadiscovd is related to the discovery service IIRC.

Your backup probably failed if McAfee blocked the Portmapper since that could technically prevent an RPC connection from being established to the remote system you were attempting to backup.

 

[speshalyst]

Catirpc usually uses port 111
Cadiscovd might pick up a random available port.

So it Shall be Written!
So it Shall be Done!!