Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 51)

6000 − X11 TCP port for remote connections. Low to moderate risk, but again, this should be LAN only.

Actually, this can include ports 6000−6009 since X can support multiple displays and each display would

have its own port. ssh's X11Forwarding will start using ports at 6010.

6346 − gnutella.

6667 − ircd, Internet Relay Chat Daemon.

6699 − napster.

7100−7101 − Some font servers use these ports. Low risk, but LAN only.

8000 and 8080 − common web cache and proxy server ports. LAN only.

10000 − webmin, a web based system administration utility. Low risk at this point.

27374 − SubSeven, a commonly probed for Windows only Trojan. Also, 1243.

31337 − Back Orifice, another commonly probed for Windows only Trojan.

More services and corresponding port numbers can be found in /etc/services. Also, the "official" list is

http://www.iana.org/assignments/port−numbers.

A great analysis of what probes to these and other ports might mean from Robert Graham:

http://www.linuxsecurity.com/resource_files/firewalls/firewall−seen.html. A very good reference.

Another point here, these are the standard port designations. There is no law that says any service has to run

on a specific port. Usually they do, but certainly they don't always have to.

Just a reminder that when you see these types of ports in your firewall logs, it is not anything to go off the

deep end about. Not if you have followed Steps 1−3 above, and verified your firewall works. You are fairly

safe. Much of this traffic may be "stray bullets" too −− Internet background noise, misconfigured clients or

routers, noisy Windows stuff, etc.

8.3. Netstat Tutorial

8.3.1. Overview

netstat is a very useful utility for viewing the current state of your network status −− what servers are

listening for incoming connections, what interfaces they listen on, who is connected to us, who we are

connect to, and so on. Take a look at the man page for some of the many command line options. We'll just

use a relative few options here.

As an example, let's check all currently listening servers and active connections for both TCP and UDP on

our hypothetical host, bigcat. bigcat is a home desktop installation, with a DSL Internet connection in this

example. bigcat has two ethernet cards: one for the external connection to the ISP, and one for a small LAN

with an address of 192.168.1.1.

Security Quick−Start HOWTO for Red Hat Linux

8.3. Netstat Tutorial 48

1 2 ... 46 47 48 49 50 51 52 53 54 55 56 ... 81 82

Nessun commento

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 51