[ale] port 2301 logs

[Michael Smith]

It's amazing how many people are using this.  My firewall logs at least 30 -
40 denied connection attempts per minute on this port.  I am just going to
quit logging denieds on this port.  It's starting to affect the throughput
on my firewall.

-----Original Message-----
From: Ben Conrad [mailto:bconrad at genuity.com]
To: ale at ale.org
Sent: Monday, October 02, 2000 4:52 PM
To: 'Jonathan Rickman'; Michael Smith
Cc: 'ale at ale.org'
Subject: RE: [ale] port 2301 logs 


Stop and disable the "Compaq Web Agent" from Control Panel -> Services.  To
test to a "netstat -na |findstr 2301" before and after stopping the service.

Ben.



____________________________________
 Ben Conrad
 NT Administrator, NOS Team
 GENUITY INC.
 617.873.5146
 bconrad at genuity.com
____________________________________ 
   

> -----Original Message-----
> From: Jonathan Rickman [mailto:jonathan at xcorps.net]
> Sent: Monday, October 02, 2000 1:56 PM
> To: Michael Smith
> Cc: 'ale at ale.org'
> Subject: Re: [ale] port 2301 logs 
> 
> 
> On Mon, 2 Oct 2000, Michael Smith wrote:
> 
> > I was wondering if anyone knows what port 2301 is used for 
> typically.  I
> > have been getting the following in my log files and I was 
> just wondering..
> > 
> > Oct  2 12:08:53 hercules kernel: Packet log: input DENY 
> eth1 PROTO=17
> > 209.187.166.40:2301 255.255.255.255:2301 L=40 S=0x00 
> I=52723 F=0x0000 T=128
> > (#103) 
> > Oct  2 12:09:02 hercules kernel: Packet log: input DENY 
> eth1 PROTO=17
> > 209.186.118.200:2301 255.255.255.255:2301 L=40 S=0x00 
> I=27589 F=0x0000 T=128
> > (#103) 
> > Oct  2 12:09:08 hercules kernel: Packet log: input DENY 
> eth1 PROTO=17
> > 209.186.14.17:2301 255.255.255.255:2301 L=40 S=0x00 I=53327 
> F=0x0000 T=128
> > (#103) 
> 
> 
> Is this on a LAN? Is 209.186.14.17 a Compaq ProLiant? I bet so...
> 
> If so, and you figure out how to make it shut up...please let me know.
> We have an ProLiant running NT that sends out these broadcasts every
> minute and it's rather annoying. We've just started filtering it out
> recently after many attempts to shut it up.
> 
> -- 
> Jonathan Rickman
> X Corps Security
> http://www.xcorps.net
> 
> 
> -----BEGIN PGP PUBLIC KEY BLOCK-----
> Version: PGP 6.5.2
> 
> mQENAzm0QZQAAAEIAN3uNRQlWHMrHwKgTNzpYps6SLipfNvH+0uZi0TvxyXFHiiH
> kivQYxlcPn/4Za4eyl5XZvP6lGQ3DXcCzT+9di75HqFtTiHeE9YScR0WEeBB1ywL
> j8nKxFdGMCJ3a3khSafPvyTUQKGaEWQGnui+6UieWeBhDHdE/o21qNd0+6M49P73
> 0pVTdmdn1jPj1cU+vrqkNWMfNNNhLyPjrdPzoL6SoYzCs6p5YhLWaNOiet/91RhK
> VpC8uy2cUIWNOAyAOtDJwF4GY+AIVP2WTLg6L/FByDH507HP4NvkbnwPAkDSTh7M
> TlXvdoeNiaEUCYCgx8CFSCAg/pl819+gts810D8ABRG0JkpvbmF0aGFuIFJpY2tt
> YW4gPGpvbmF0aGFuQHhjb3Jwcy5uZXQ+iQEVAwUQObRBlNffoLbPNdA/AQETwwf/
> d4W131UXeWd1+hcCR1bkFJRx+08fNtHzbMzjqquA4IRPftt72M6RzDsRn1xpsdh+
> RqP0oeZ0IfnByhXQ7x65JxRUaYW2mw8GNQOeTkJ2uNDg3SaFG2HGYxASohP2r8D6
> Yh1WIfEgf3YDwoKyGAfJTgcfHZe85+hgg6R60KbGMAhWf5Tbb6IEpzdvBi/HoYHC
> c1km8esjnMPDmR1aLjcRffaMmWGwXk/33oZRo3Q0SO/MvqWyo1kZnq2JIxX0MDAm
> nm2p0cZtQc1sECkC1XyyyH8tgWhXwzYpucpsQ3IhWFrCuL7y4t/wREOgd4KaSxkN
> OKraa8g7Nyh4s8rSHFvq5A==
> =XYFV
> -----END PGP PUBLIC KEY BLOCK-----
> 
> --
> To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" 
> in message body.
> 
--
To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" in message
body.
--
To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" in message body.