TCP Ports 2694 & 2695

[MikeBatters]

Just a quick question....

Has anyone come across apps/services that listen on TCP 2694 & 2695?

I have done all the usual checks (google/RFCs/Many Published Port Lists) etc with no joy at all...

From the hosts involved it looks like a Symantec Storage Foundation port but it is not on of the documented ports (of which there are many)...

Thanks in advance .....

Mike

*************************************

Remember - There is always another way..........I just haven't found out what it is yet!

 

[gmail2]

It could literally be anything ! Have you tried telnetting to the port from another machine to see what king of output you get? This may give you some clue. Also, telnet to that port from another machine & run netstat -o ... the o option tells you the PID responsible for that traffic. Once you have that you can check the process name in task manager. Other than that I have no idea I'm afraid

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[gdvissch]

If this is on XP clients, try "netstat -ano" in a command prompt
It will list the process ID of process using the port
G.

 

[gmail2]

sorry, my post was very badly worded -this is what I was also trying to suggest

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[burtsbees]

Not if it established---the TCP port that is used by the responding node will be random. For example, while connected to the internet, look at what port it reports for your host (local address) on an internet connection---it won't be 80...now on the host that listens on these ports, as long as it is not established, the source port will be the known port.
But what I don't know is what to do with the PID once you have it...

Burt

 

[gdvissch]

Once you have the PID, you can check in taskmanager which process is actually using the port on your system in real time. It could be a know port that is used by a trojan, or what have you ...

If the PID is not shown in your default taskmanger view you must add the column via the menus
G.

 

[burtsbees]

That's the part I am having trouble with---adding the port view via menues...but I have it now. I loaded XP Pro back on my laptop this weekend (had Vista, then XP dual boot with SuSE 10.0, then Vista again, now back to XP, dual boot with Ubuntu 8.10).

Burt