Why is ProFTPD responding to active connections using Covia?
I Googled for Covia/port 64 and didn't get any information that was either useful or that I could understand. Entirely possible my Google Fu is weak so I get it if you respond with a link you found on Google that you feel explains this.
I installed ProFTPD on my Ubuntu server. Using Wireshark I'm seeing that when my PC initiates an active FTP session to my server, the responding port (the data connection port) on the server is not port 20 as I would expect, but port 64, which belongs to some process called Covia.
Port name resolution is by default based on the /etc/services "database". The file contains official (IANA) and local assignments. Since these are static (as opposed to active probing) port - name pairs resolution can be off at times. IMO the easiest way to confirm it actually is FTP-ish traffic and not the Covia Communications Integrator protocol would be to have Wiresharks FTP traffic dissector display actual packet capture contents.
|All times are GMT -5. The time now is 11:50 AM.|