Port 113

Archived from groups: comp.security.firewalls (More info?)

I recently noticed in my firewall logs incoming packets to my port 113,
coming from various IP addresses. Does anyone know what this means? I
don't recall seeing it before, but in the last day or two it seems to be
happening a lot. Right now the firewall is blocking them. Everything
seems to work fine otherwise. Any ideas why this is happening?

--
Kerodo

Archived from groups: comp.security.firewalls (More info?)

In article <slrncf4hkd.u4v.BitTwister@wb.home.invalid>,
BitTwister@localhost.localdomain says...
> On Mon, 12 Jul 2004 01:02:14 -0700, Kerodo wrote:
> > I recently noticed in my firewall logs incoming packets to my port 113,
> > coming from various IP addresses. Does anyone know what this means? I
> > don't recall seeing it before, but in the last day or two it seems to be
> > happening a lot. Right now the firewall is blocking them. Everything
> > seems to work fine otherwise. Any ideas why this is happening?
>
> infected machines hitting your box. Normal noise.
>
> http://isc.sans.org/port_details.php?port=113
>

Ok, thanks...

--
Kerodo

Archived from groups: comp.security.firewalls (More info?)

Hallo Kerodo, you wrote:

> In article <slrncf4hkd.u4v.BitTwister@wb.home.invalid>,
> BitTwister@localhost.localdomain says...
> > > I recently noticed in my firewall logs incoming packets to my port 113,
> > > coming from various IP addresses.

> > infected machines hitting your box. Normal noise.
> > http://isc.sans.org/port_details.php?port=113

One explanation but not the only one: Port 113 is the ident service,
often used in conjunction with smtp and/or ftp (look in your firewall
log). So, if you want to use a smtp server, you must have an ident
server or you have to reject 113-packets correctly and not to drop.

HTH
Wolfgang

Archived from groups: comp.security.firewalls (More info?)

"Juergen Nieveler" <juergen.nieveler.nospam@arcor.de> wrote in message
news:Xns9524C7AD36561juergennieveler@nieveler.org...
> Wolfgang Ewert <w.ewert2002@gmx.de> wrote:
>
> > One explanation but not the only one: Port 113 is the ident service,
> > often used in conjunction with smtp and/or ftp (look in your firewall
> > log). So, if you want to use a smtp server, you must have an ident
> > server or you have to reject 113-packets correctly and not to drop.
>
> IDENT is also used by IRC-servers quite often, IIRC.
>
> Juergen Nieveler
> --
> "I know the human being and fish can coexist peacefully"
> George W. Bush --Saginaw, Mich., Sept. 29, 2000

yup, it is