What's up with port 79 ?

Published: 2012-06-27
Last Updated: 2012-06-27 13:42:43 UTC
by Daniel Wesemann (Version: 2)
6 comment(s)

 

ISC reader Yew Chuan reports that he is seeing a steady increase in probes to tcp/79 ("finger"). Our own DShield sensors confirm this observation, as is visible on the image below. It's been a while since we last had exploit attempts on tcp/79, and hardly anybody is using/running "finger" anymore these days. So .. what's up? Anyone got packets?

Update 1330 UTC:  Scanning for tcp/79 has been seen by many ISC readers, and most say the IP blocks it originated from are in China and Taiwan. No packets yet - looks like everyone has tcp/79 blocked, and only recorded the initial "SYN".

 


 

Keywords: probe scanning
6 comment(s)

Comments

Looking at my logs, I see a spike yesterday....but that's really all. It looks like most of it was sourced from China and Taiwan. I don't have packets, but I might be able to post source IPs later.
Russian Federation, US, Ukrain, India, and Brazil as well starting and dropping off yesterday. Loooking into getting more info.
Has anyone also been seeing an uptic in tcp/179 ? I'm thinking the number can't be a coincidence. I'm actively seeing a pretty good bit from Europe, Asia, etc.
My guess is that yesterday's spike was a typo - someone's scanning for vulnerable BGP hosts today.
Got a tarpit up on 79, let's see what happens.
Definitely seeing a large amount on 179, will attempt to capture some activity and send it in.

Diary Archives