What's up with port 79 ?

Published: 2012-06-27. Last Updated: 2012-06-27 13:42:43 UTC
by Daniel Wesemann (Version: 2)
6 comment(s)

 

ISC reader Yew Chuan reports that he is seeing a steady increase in probes to tcp/79 ("finger"). Our own DShield sensors confirm this observation, as is visible on the image below. It's been a while since we last had exploit attempts on tcp/79, and hardly anybody is using/running "finger" anymore these days. So .. what's up? Anyone got packets?

Update 1330 UTC:  Scanning for tcp/79 has been seen by many ISC readers, and most say the IP blocks it originated from are in China and Taiwan. No packets yet - looks like everyone has tcp/79 blocked, and only recorded the initial "SYN".

 


 

Keywords: probe scanning
6 comment(s)

Comments

Looking at my logs, I see a spike yesterday....but that's really all. It looks like most of it was sourced from China and Taiwan. I don't have packets, but I might be able to post source IPs later.

KNS

Jun 27th 2012
1 decade ago

Russian Federation, US, Ukrain, India, and Brazil as well starting and dropping off yesterday. Loooking into getting more info.

mrtrick

Jun 27th 2012
1 decade ago

Has anyone also been seeing an uptic in tcp/179 ? I'm thinking the number can't be a coincidence. I'm actively seeing a pretty good bit from Europe, Asia, etc.

Matt

Jun 27th 2012
1 decade ago

My guess is that yesterday's spike was a typo - someone's scanning for vulnerable BGP hosts today.

Sean

Jun 27th 2012
1 decade ago

Got a tarpit up on 79, let's see what happens.

Yin

Jun 27th 2012
1 decade ago

Definitely seeing a large amount on 179, will attempt to capture some activity and send it in.

YinIzanami

Jun 27th 2012
1 decade ago

Login here to join the discussion.


Top of page
Diary Archives