Someone is scanning port 1663..

[paul123456]

Hi i have my firewall setup to were it emials me if there any attacks done to it. it has emailed me 75 times last night and all were blocked. it has muliple source ip address.. the destination address is ofcourse me but it is using multiple source ports to get to port 1663 I did a search for it on the net and only found that it's common name is netviewaix2 netviewaix3. Does anyone know what port 1663 and what a hacker could used this port for? what information can he/she get from it? or does someone no of any exploits in win2k server?

Thanks, PAUL

 

[WheeDoggy]

as long as you don't see something like this you are ok

TCP datding:1663 XCNLM02S:nbsession ESTABLISHED

 

[paul123456]

well i dunno what happend but i just got a notification...If you can as you say "as long as it not this" i would like to no what is this..what does it do...and how is it caused? and what can i do from preventing it? what is it? explain plz

Thanks, PAUL

 

[chiph]

You can't stop it - it's someone on the other end of the connection (or their software) attempting to connect to your machine.

It may be an innocent mistake (transposed IP address numbers), or someone scouting for an open system. Best to look up their ISP and have them send them a "don't do that" email.

What you shouldn't do is attempt to contact them yourself - there have been instances where a person was hauled into court be cause the other person (who initiated it in the first place) called the cops.

Chip H.

 

[WheeDoggy]

i have to agree with chiph.

as of now, i do not know of any exploits here - i even did a google search.

if it continues, do a lookup on the ip and report it.

 

[wbg34]

Unless you are running AIX with Netview don't worry about it unless of course they connect. It is just someone fishing. 1663 is the tcp port that Netview uses on AIX machines and there are known issues with Netview.

 

[Grenage]

And of it's always possible that is a script kiddy trying to connect to a trojan, you can generally set those up for any port you wish.

Still, as whee said as long as your firewall is blocking it your ok.