Your right, port 113 is used for "auth" or identd. This is a mechanism
used to verify connecting systems and is used frequently in combination
with SMTP connections.
If you check your logs, you will probably see that port 25 is hit at about
the same time as the 113 hit.
Hope this helps....
Steve
---------------------------------------------------------------
Steve Conner Cypress Consulting, Inc.
sconner @
cycon .
com 703-256-1279
Manager, Research & Development http://www.cycon.com
CYCON Labyrinth, Firewall and Network Address Translator
---------------------------------------------------------------
On Thu, 24 Oct 1996 jconnary @
shepards .
com wrote:
>
> Hi,
>
> can anyone tell me please what port 113 is used for. Cheswick and
> Bellovin say it
> is called "auth" and is generally safe. I see alot of requests to this port
> from various locations. Is this
> something to be alarmed about. We are running an ANS Interlock version 4.0 on
> Solaris 2.5. The message I
> get in my log files looks like:
>
> Oct 24 14:36:51 inbound unix: FROM=199.171.006.012, TO=192.104.069.008,
> PORT=113
> , PROT=tcp, MSG=Unused Port Probe
>
> Thanks,
> Julie Ann Connary
> Network Specialist
> Shepard's McGraw-Hill
> 719-481-7383 (FAX: 719-488-5135)
>
References:
-
port 113
From: jconnary @
shepards .
com
|
|
