[ale] port 32772?

[Russell Hogg]

There are a few references to it online


http://www.sans.org/y2k/1231stutzman.htm


Port 32772: As stated in an e-mail earlier, there are several possibilities
associated with this port. I found several possible clues as to the identity
of port 32772, but nothing conclusive:
I have seen newsgroup postings referring to this port in the context of
Linux DNS configurations. 
This port is also referenced in Gaming circles (Doom and Quake) for
multi-player configurations 
I found 32772 in a config file for "Novel Netware for Small Business". The
specific file associated was AIODGAPR.NLM, assigned to port 32772. The file
appears to be dated 1-23-1997 
CERT-CC has also reported 32772/TCP scans. They have called it "within
acceptable limits". 
I found one other Usenet posting from a German sysadmin suggesting 32772 may
have something to do with nntp service. I don't have much confidence in this
one, but who knows... His posting was from September.



Russ



_________________________________________
russellh at x-soft.com


-----Original Message-----
From: Joe Steele [mailto:joe at madewell.com] 
To: ale at ale.org
Sent: Thursday, January 31, 2002 12:34 PM
To: 'hirsch at zapmedia.com'
Cc: ale at ale.org
Subject: RE: [ale] port 32772?

On Wednesday, January 30, 2002 10:30 AM, hirsch at zapmedia.com wrote:
>
> Randy Janinda writes:
>  > Since it's your box just run
>  >
>  > 'fuser -n tcp 32772'
>  > then check the 'ps' listing for the pid that is returned.
>
> Sorry, I should have mentioned that fuser doesn't report anything, but
> I can telnet to that port, so something is there.  I can't find that
> port in the xinetd.d/* files.
>

That's curious.  Does the port show up in the "LISTEN" state 
with 'netstat -an'?  If THAT doesn't show anything, then I suppose 
"grep ':8004 ' /proc/net/tcp" doesn't show anything either?

--Joe

---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be

sent to listmaster at ale dot org.

---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be 
sent to listmaster at ale dot org.