RE: PORT # Question... Am I being hacked ?

[thomas@xxxxxxxxxxx]

Chuck:

On Wed, April 10, 2002, Chuck Lewis wrote

> > I am running Windows NT and ran a Netstat command and among
stuff that
> does
> > NOT worry me is the following that DOES:
> >
> > ProTo Local Address Foreign Address State
> >
> > TCP gr30:2342 clt74-35-022.carolina.rr.com:1214 ESTABLISHED
> >
> > the local address is my PC's name.
> >
> > is the :2342 a Port # - if so, what is it for ?
> > is the :1214 a Port # - if so, what is it for ?

This URL may help:

 http://www.iana.org/assignments/port-numbers

It's the official registry and includes a basic definition of
"Well Known Ports", "Registered Ports" and "Dynamic and/or
Private Ports". Pretty much everything you need to know in very
few words.

Beyond what you _need_ to know, you might also be interested in:

 http://www.sans.org/newlook/resources/IDFAQ/oddports.htm

which is titled "What port numbers do well-known trojan horses
use?".

I'd suggest loading a personal firewall. The one I use on every
PC I control is ZoneAlarm (which is freeware). There's a period
of a day or two after initial installation when it asks you to
verify just about every kind of network interaction until it
builds its image of what you're doing, but then it stays pretty
quiet until something unusual hits.

Tom Liotta

--
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788
Fax  253-872-7904
http://www.400Security.com
___________________________________________________
The ALL NEW CS2000 from CompuServe
 Better!  Faster! More Powerful!
 250 FREE hours! Sign-on Now!
 http://www.compuserve.com/trycsrv/cs2000/webmail/