RE: port 1241 MSG

["Joe Giles" <jgiles () joeman1 com>]

I think you hit the nail on the head. We use the nessesd. That is what it
was. I think I will block it because we only monitor using nessus localy.

Thanks for the help


-- 
Joe Giles
jgiles () joeman1 com
AOL: mcigiles

-------
Registered Linux User #264910 http://counter.li.org
-------

US - San Francisco said:
> 1241 is definitely a nessus port but kazaa typically (.. this can be
> changed) resides on 1214
>
> -----Original Message-----
> From: Wirth, Jeff [mailto:WirthJe () DNB com]
> Sent: Friday, October 18, 2002 9:08 AM
> To: 'jgiles () joeman1 com'; snort-users () lists sourceforge net
> Subject: RE: [Snort-users] port 1241 MSG
>
>
> From: Joe Giles [mailto:jgiles () joeman1 com]
> > List, I used nmap to scan my network form the internet and
> > while all the
> > ports that I don't use were closed, one was open. It is port
> > 1241 and this
> > was defined:
> >
> > 1241 TCP MSG remote message service
> >
> > Should I close this to the internet? Is there a possible
> > vulnerability here?
>
> hmmm...well there are a couple of things, off the top of my head, that
> live on this port... nessus and kazaa.  It sounds like you are
> responsible for firewall administration...why was the port opened in the
> first place?  have you talked with your server adminstrator(s) to find
> out what's running on the box?
>
> - Jeff
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> This message (including any attachments) contains confidential
> information intended for a specific individual and purpose, and is
> protected by law.  If you are not the intended recipient, you should
> delete this message.  Any disclosure, copying, or distribution of this
> message, or the taking of any action based on it, is strictly
> prohibited.
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users





-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users