Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Has anyone monitored various requests from all over the world on Port 17275 via UDP? My firewall logs show huge amounts of such requests from lots of different IP Adresses.

I can't find any documented service which shall use this port. Anyone knows what piece of software may cause these requests?

share|improve this question
    
I would suggest posting an example of the log files if your serious about finding anything out about this 'attack' and reading up on how firewalls work –  NULLZ Apr 18 '13 at 8:50
    
Thanks for your comment. I was asking for other people who recognized packages on that port, not on how firewalls work. Posting my logs wouldn't be of help I guess - you'll only see iptables logging the drop of such packages from various sources. And I chose the tag attack since I supposed to reach the right people that way - sorry if it was misleading –  gue Apr 19 '13 at 8:29
    
the problem here is that ANY configurable service or malware can use that port. If you don't have anything listening on that port, there's no danger to you. If you want to determine what's going on in a more general/investigative sense, run a packet capture on that interface and see what traffic is trying to connect to that port. You could even try and connect back to the original host, do a port scan and see what services are running on the 'attacking' side. –  NULLZ Apr 20 '13 at 3:07
add comment

2 Answers

Port 17275 is not registered to any specific service so it can be any application that's configured to listen on that port.

Remember that:

  • Well Known Ports are: 0 through 1023.

  • Registered Ports are: 1024 through 49151.

  • Dynamic/Private are: 49152 through 65535.

Some googling shows that several pieces of malware seem to use this specific port for communications.

share|improve this answer
    
D3C4FF thanks for proposing an answer. Since I couldn't find anything on google you might want to help me out in finding the right search terms? –  gue Apr 19 '13 at 8:32
add comment

If it's not anything registered it might very well be a UPnP vulnerability. In this case, a device on a LAN is infected (e.g. a "smart" TV), opens port 17275 on the home router via UPnP (see this answer) and waits for a connection.

I'd suggest setting up a honeypot on that port and listen for what comes in for a starter.

The nice folks at SANS' ISC might be offer you some more advice.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.