connection attempts to port 135?

[dogsbod]

Hi,

I see numerous attempts to connect to port 135 on the wan interface in firewall log, how do I determine what app\service is doing this? Is it anything to be concerned about?

thanks

 

[pechenegs]

yes spyblaster worm uses this port. block it! sygate pro and kerio firewalls will allow you to set rules to block this port.

http://grc.com

pech

 

[theoxyde]

Yup. That's the RPC port. The blaster worm that went around this past August (and derivatives) try to come in on that port.

 

[Salem]

A list of port numbers and their official uses

http://www.iana.org/assignments/port-numbers

--

 

[dogsbod]

thanks