Port 1975?

[Kathleen]

We are seeing some traffic on our network throught port 1975. Does anyone know what would run through that port (any specific apps or anything)?
Thanks

[Stefan Farrelly]

1975 is too big to be registered to someone - its probably some local app or program which has just 'picked' a port to use. Its not on the list of registered TCP ports;

http://www.iana.org/assignments/protocol-numbers

and I cant find it on this site either;

http://www.chebucto.ns.ca/~rakerman/port-table.html

Check your /etc/services file just in case someone did bother to put it in there with a comment as to what its for, otherwise simply block it and wait and see who complains!

[Jeff Schussele · Accepted solution]

Hi Kathleen,

Believe this is coming from advert.dll in a shareware program from aureate.com.
It uses CuteFTP to "pull" ads as a "price" for the shareware.
I HATE this stuff & am not sure if you can kill it.

See the following for more info


http://cert.uni-stuttgart.de/archive/incidents/1999/12/msg00009.html

http://www.shmoo.com/mail/fw1/msg01404.html

HTH,
Jeff

[A. Clay Stephenson]

Since that is not a registered port, one approach would be to use lsof and grep for 1975. That should reveal the process in question.

[Jeff Schussele]

Here's some more definitive info:

http://lists.insecure.org/incidents/1999/Dec/0001.html

Includes links to aureate.com

Rgds,
Jeff

[Jon Mattatall]

Everything I can find suggests that the activity on 1975 is caused by freeware calling home, specifically things like GoZilla and CuteFTP. Check these security advisories....

http://www.onecall.net/policy_complaint.html#access-aureate

http://lists.insecure.org/incidents/1999/Dec/0001.html

Jon

[George_Dodds]

Gozilla uses this port

http://www.shmoo.com/mail/fw1/jun99/msg01404.html

[MANOJ SRIVASTAVA]

Hi Kathleen

In our produciton env it was being used by a CCH process , I think the best bet would be find out using lsof .

May be you will look at :

"Our site had begun getting these port 1975 jewels several months back. When
I tracked it down to the originating IPs (several workstations had it..), I
found that the users had downloaded and installed the GoZilla! app. We're
fortunate here in that we have the latitude to deny usage of 'non-approved'
software within our WAN, so the short-term fix was simply to block the port
at the firewall system's inner router (keeps it out of your firewall's
logs), and to notify the users of their 'dead' app. Don't know of other
programs that may use the port, but DO know that it's usage isn't currently
validated at this location. Makes life a *bit* simpler for sysadmins when
the organization is willing to stand behind a documented security policy,
too ."

This is from google search on Port 1975.


Manoj Srivastava