PDA

View Full Version : Firewall Port 1026/1027

Blacklash
03-11-05, 10:01 PM
Anyone know what is on this port? My firewall is getting regularly pounded like a cheap pornstar at this location from all over the internet. What is the interest in 1026/1027?
rewt
03-12-05, 06:48 AM
My guess is it's another Microsoft vulnerability/exploit :rolleyes:

Nmap says

1026/tcp = LSA-or-nterm
1027/tcp = IIS
retsam
03-12-05, 07:36 AM
Anyone know what is on this port? My firewall is getting regularly pounded like a cheap pornstar at this location from all over the internet. What is the interest in 1026/1027? there are a series of worms that listen on ports 1026,1027 and 1029 as long as your firewall is blocking it i wouldnt worry about it.... oh wait is the on your pc's own firewall or at your network boarder? if its your pc's then worry something is not right on your network.
Blacklash
03-12-05, 01:33 PM
It's spam my firewall is blocking that is incoming udp 1026/1027. After looking around from what I understand is that many folks have windows auto set their messenger to port 1026. So people that like to send out floods of those pop up messages tend to target it. I have messenger turned off, my system patched and that port blocked. They say many of the spammers use Udp because a "handshake" isn't required like tcp so they just flood junk out.

So odds are very high it is intended messenger spam.
CaptNKILL
03-12-05, 03:33 PM
How do I go about seeing the port activity on my system\network? I have XP Sp1 and a Linksys 10\100 router.
retsam
03-12-05, 08:24 PM
How do I go about seeing the port activity on my system\network? I have XP Sp1 and a Linksys 10\100 router. use ethereal .... its a free network sniffer ... this will tell you what is hitting your machine....

http://www.ethereal.com/
retsam
03-12-05, 08:25 PM
oh i just realized that you have a router ...so you want to see whats hitting your router.... ummmm remove your router and hook your machine right into the network connection.... this is about the most comprehensive way of doing it
rewt
03-13-05, 04:36 PM
remove your router and hook your machine right into the network connection....

Not such a great idea really, this leaves his system open to all kinds of attacks. I would suggest at least enabling XP firewall before hooking his box directly to the net.