Loading...
[get complete service list]
Top of page
Top of page
Port Information
Protocol Service Name
tcp garcon garcon
udp applix Applix ac
tcp puprouter puprouter
udp puprouter puprouter
tcp Chatpower [trojan] Chat power
tcp DeepThroat [trojan] DeepThroat
tcp Foreplay [trojan] Foreplay
tcp WinSatan [trojan] WinSatan
Top IPs Scanning
Today Yesterday
152.89.198.127 (1)185.224.128.17 (673)
141.98.11.79 (1)154.81.156.20 (371)
185.224.128.17 (1)162.19.102.222 (357)
87.121.69.52 (1)185.218.84.165 (218)
162.216.150.53 (1)185.242.226.34 (108)
User Comments
Submitted By Date
Comment
Mikael Olsson 2009-10-04 18:45:22
Port 999, TCP as well as UDP, is also used for remote administration of Clavister Firewall (www.clavister.com). Recurring UDP 999 "probes" can mean that someone mistyped the address of a firewall in the management tool, which periodically (app. once a minute) "pings" all firewalls it knows about. High volumes of UDP 999 packets can also mean that a firewall was configured to send log data to the wrong IP address. (Perhaps a less likely mistake to make.) TCP traffic related to this is least likely to occur "frequently"; it will only occur when someone is manually trying to do something in the admin tool. Note that traffic related to Clavister Firewall management would be targeted against a single (or a few) IP addresses. Scan sweeps for port 999 covering several addresses would NOT be related to the above. Addresses like 1.2.3.4 and such are however known to be frequent targets of UDP 999 probes from multiple sources :)
2003-02-21 02:58:12
This port is also used by Microsoft ActiveSync and Pocket PC devices.
Top of page
CVE Links
CVE # Description
Top of page