LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-15-2016, 10:12 AM   #1
Mr Wolf
LQ Newbie
 
Registered: Dec 2012
Posts: 2

Rep: Reputation: Disabled
what runs on port 32764 and 49152? (ctd)


It'a a backdoor. ...
 
Old 03-16-2016, 03:21 PM   #2
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,659
Blog Entries: 4

Rep: Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941
Not necessarily. Port-numbers (above 1024) might be used for any number of [legitimate ...] reasons. What's interesting is when a port is listening for incoming connections: if you don't know what it is or why it's doing that, then it probably should raise at least your curiosity, but it is not ipso facto cause for panic.

If the port-number is being used simply for an active connection, then ... well, for instance, "that's how routers work" (on their Internet-facing side). The port-number that's being used for a connection might have been picked more-or-less at random. Distinct connections simply need to grab a port-number (that's not on that list), and, pretty much, any port-number will do. Port-numbers basically exist to disambiguate multiple connections at the same IP-address.

A protocol will commonly use "a well-known port number" (upon which some service somewhere is listening), to negotiate the terms of a future conversation. Having agreed upon a (random ...) port-number to use, the two parties will then initiate the new conversation. Each such conversation uses its own port. When the conversation ends, the original port-number is forgotten.

Last edited by sundialsvcs; 03-17-2016 at 07:23 AM.
 
Old 03-16-2016, 11:31 PM   #3
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 17,624

Rep: Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651Reputation: 2651
9 years for "backdoor"

high number ports are used A LOT now ( 9 years later ) for torrents and i2p and such
i normally set ktorent to use ports in the 40,000 to 65,535 range

isp's do block things using
6881-6889 ,4662, 4672

back in 01 to 07 emule WAS being blocked so 48000 + got used a lot

Last edited by John VV; 03-16-2016 at 11:35 PM.
 
Old 03-17-2016, 05:02 AM   #4
Mr Wolf
LQ Newbie
 
Registered: Dec 2012
Posts: 2

Original Poster
Rep: Reputation: Disabled
Mmmm... I think in this case it's actually a backdoor.

By the way, I resumed this ooooold topic - and made some necroposting - because, while searching information about this, for example here:
http://www.computerworld.com/article...ur-router.html
it says this topic was left unanswered, and I could't resist.
Now, it's not unanswered anymore.
 
Old 03-19-2016, 05:38 AM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by Mr Wolf View Post
Mmmm... I think in this case it's actually a backdoor.
No. The OP did not give any relevant details for you to be able to determine that. I'll move your necropost to its own thread.


Quote:
Originally Posted by Mr Wolf
I'm Winston Wolf. I solve problems.
Since this is your second post in 6 years you might want to work on your problem solving methods.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: Six-port net appliance runs Yocto on Braswell LXer Syndicated Linux News 0 08-13-2015 08:02 AM
how to access apache which runs other than the default port dinakumar12 Linux - Server 3 02-29-2012 03:42 AM
what runs on port 32764 and 49152? cope Linux - Security 1 09-30-2007 02:53 AM
which service runs on port 806? nirmaltom Linux - Security 4 01-17-2007 05:08 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 01:13 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration