[Snort-users] port 1241 MSG

Joe Giles jgiles at ...6534...
Fri Oct 18 13:37:03 EDT 2002


I think you hit the nail on the head. We use the nessesd. That is what it
was. I think I will block it because we only monitor using nessus localy.

Thanks for the help


-- 
Joe Giles
jgiles at ...6534...
AOL: mcigiles

-------
Registered Linux User #264910 http://counter.li.org
-------

US - San Francisco said:
> 1241 is definitely a nessus port but kazaa typically (.. this can be
> changed) resides on 1214
>
> -----Original Message-----
> From: Wirth, Jeff [mailto:WirthJe at ...4876...]
> Sent: Friday, October 18, 2002 9:08 AM
> To: 'jgiles at ...6534...'; snort-users at lists.sourceforge.net
> Subject: RE: [Snort-users] port 1241 MSG
>
>
> From: Joe Giles [mailto:jgiles at ...6534...]
>>
>> List, I used nmap to scan my network form the internet and
>> while all the
>> ports that I don't use were closed, one was open. It is port
>> 1241 and this
>> was defined:
>>
>> 1241 TCP MSG remote message service
>>
>> Should I close this to the internet? Is there a possible
>> vulnerability here?
>>
>>
>
> hmmm...well there are a couple of things, off the top of my head, that
> live on this port... nessus and kazaa.  It sounds like you are
> responsible for firewall administration...why was the port opened in the
> first place?  have you talked with your server adminstrator(s) to find
> out what's running on the box?
>
> - Jeff
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> This message (including any attachments) contains confidential
> information intended for a specific individual and purpose, and is
> protected by law.  If you are not the intended recipient, you should
> delete this message.  Any disclosure, copying, or distribution of this
> message, or the taking of any action based on it, is strictly
> prohibited.
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users







More information about the Snort-users mailing list