Commonly hacked ports

[Alan <alano @ teleport . com>]

I am setting up a few booby traps (ala Klaxon and the like) for various
ports on my firewall at work.  Any suggestions as to "commonly hacked
ports" that I should put detectors on?  (I am currently covering the
obvious ones like tftp and nfsd.)

Also, suggestions on good ways to identify attackers (other than identd
and finger) are also welcome.

alano @
 teleport .
 com | "Those who are without history are doomed to retype it."