0

Has anyone monitored various requests from all over the world on Port 17275 via UDP? My firewall logs show huge amounts of such requests from lots of different IP Adresses.

I can't find any documented service which shall use this port. Anyone knows what piece of software may cause these requests?

3
  • I would suggest posting an example of the log files if your serious about finding anything out about this 'attack' and reading up on how firewalls work
    – NULLZ
    Apr 18, 2013 at 8:50
  • Thanks for your comment. I was asking for other people who recognized packages on that port, not on how firewalls work. Posting my logs wouldn't be of help I guess - you'll only see iptables logging the drop of such packages from various sources. And I chose the tag attack since I supposed to reach the right people that way - sorry if it was misleading
    – gue
    Apr 19, 2013 at 8:29
  • 1
    the problem here is that ANY configurable service or malware can use that port. If you don't have anything listening on that port, there's no danger to you. If you want to determine what's going on in a more general/investigative sense, run a packet capture on that interface and see what traffic is trying to connect to that port. You could even try and connect back to the original host, do a port scan and see what services are running on the 'attacking' side.
    – NULLZ
    Apr 20, 2013 at 3:07

3 Answers 3

1

Port 17275 is not registered to any specific service so it can be any application that's configured to listen on that port.

Remember that:

  • Well Known Ports are: 0 through 1023.

  • Registered Ports are: 1024 through 49151.

  • Dynamic/Private are: 49152 through 65535.

Some googling shows that several pieces of malware seem to use this specific port for communications.

1
  • D3C4FF thanks for proposing an answer. Since I couldn't find anything on google you might want to help me out in finding the right search terms?
    – gue
    Apr 19, 2013 at 8:32
0

If it's not anything registered it might very well be a UPnP vulnerability. In this case, a device on a LAN is infected (e.g. a "smart" TV), opens port 17275 on the home router via UPnP (see this answer) and waits for a connection.

I'd suggest setting up a honeypot on that port and listen for what comes in for a starter.

The nice folks at SANS' ISC might be offer you some more advice.

0

When using IP Telephony you will have excessive use of UDP ports as this carries the voice packets. On Telephony systems you would typically define a range of UDP ports to be used. This range will also have QoS (Quality of Service) applied to them that will prioritize the UDP packets to have the least latency across a data network

1
  • 2
    Welcome to Information Security. This seems like a guess / clarification required comment to OP. To gain enough reputation to comment on posts, you could try answering other questions.
    – Jedi
    Jul 22, 2016 at 13:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .