Re: Connection attempts to 13223

[Robert Graham <robert_david_graham () yahoo com>]

---On Mar 24, 1999, dreamwvr asked:
> anyone know what attempted connects to port 13223 are aimed at achieving.
> really found this one interesting but do not have any info on why that
> specific port what the connector hoping to achieve on this specific port??

> From http://www.robertgraham.com/pubs/firewall-seen.html#port13223
"The "PowWow" chat program from Tribal Voice. It allows users to open up
private chat connections with each other on this port. The program is very
agressive at trying to establish the connection and will "camp" on the TCP port
waiting for a response. This causes a connection attempt at regular intervalls
like a heartbeat. This can be seen by dial-up users who inherit IP addresses
from somebody who was chatting with other people: it will appear as if many
different people are probing that port. The protocol uses the letters "OPNG" as
the first four bytes of its connection attempt."

I just thought I'd mention it. During a dial-up Internet session, a friend was
getting probed by several people on this port and was wondering why. He simply
inheritted an IP addresses whose previous owner was using PowWow to chat with
people. This TCP port is used only for private chats among people --
communication with the centralized server uses a different port.

Cheers,

===
Robert Graham
"Anxiously awaiting the millenium so I can start programming
dates with 2-digits again."
_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com