[ale] Port Numbers

[infosec at alltel.net (Jonathan Rickman)]

On Sat, 24 Mar 2001, Robert Heaven wrote:

> I have my Linux firewall set up to block, and log, any incoming SYN packets. The format of the log message is:
> 
>   "date, stuff, his_IP:port, my_IP:port, otherstuff"
> 
> One of the favorite port numbers in the "my_IP:port" portion seems to be 27374. Is there some significance to this port number?
> 
> -Robert
> 

Looks like the ramen worm got ya. Head on over to

http://www.chkrootkit.org/

and get the latest version of chkrootkit. Once you've confirmed it's
existance, go to http://www.sans.org/y2k/ramen.htm nd download the removal
tool.

Good luck...

-- 
Jonathan Rickman
X Corps Security
http://www.xcorps.net



--
To unsubscribe: mail majordomo at ale.org with "unsubscribe ale" in message body.