Why are these ports open?

[mufka]

I have an NT web server that has several ports open that I can't explain. The ports are 50, 1027, 1030, 6667 and 6668. I found what the services that use these ports are, but I don't know what they do. Is there a way to find out? These ports are always open. Could these be hacked? I don't know anything about IRC, BBN IAD or RMCP.

thanks

 

[volsungs]

If security is in question go to

http://www.iss.net

and download the ISS internet scaner it's 36 megs version 6.1 is the latest.
ISS will evaluate your system and create a report that you can browse using Netscape or IE. The report will tell you what and where to go to secure your server.

 

[2ffat]

Check out

http://www.sans.org/newlook/resources/IDFAQ/oddports.htm

. You may have to go through

http://www.sans.org

front door to get to this page. It lists the well known ports that trojan horses use.
James P. Cottingham

http://www.ivcusa.com

 

[brianpaterson]

Do you need IRC for your users? I see you are affiliated as an ISP. Your users are therefore gonna be rather ticked off if you remove access to the service.

If you are running a network on the other hand burn out the port with a branding iron as it is mucho bad to allow IRC onto your internal net. Once a connection is accepted by an internal user the firewall assumes that everything is hunky dory and lets in EVERYTHING on this connection. IRC also has a dodgy setting which allows automatic acceptance of DCC (file transfers).

I would also recomend burning at the stake any users you find trying to download IRC or ICQ software onto an internal net....sorry the medication is wearing off.

Brian

 

[ifincham]

Hi,

Well port 50 is supposed to be remote mail checking as per rfc 1339 -->

http://www.cis.ohio-state.edu/cgi-bin/rfc/rfc1339.html

.

Ports 1027 & 1030 may be related to a portmap/rpc service & dynamically allocated. Port 1030 is officially BBN IAD (Bolt, Beranek and Newman Interface Access Device - a bridge/router)

Port 6667 is listed as IRC (internet relay chat) -->

http://www.cis.ohio-state.edu/htbin/rfc/rfc1459.html

&

http://www.irchelp.org/

.

In reality any rarely used port <could> be used by a trojan or other questionale s/w to run a server on. If it doubt firewall it out.

You could always do 'netstat -a' from a command window on the server to see what is connected/listening to those ports.

Rgds