Port Scan

[scotty588]

I did a port scan on my ip and found these ports open which I find suspicious. I do have a router.

TCP: **.**.**.** [80-www-http]
TCP: **.**.**.** [110-pop3]
TCP: **.**.**.** [2468-qip-msgd]
TCP: **.**.**.** [5678-rrac]
TCP: **.**.**.** [6688]

I know 80 and 110 are normal but I lookd up qip-msgd and dont know what it is and rrac is Remote Replication Agent Connection and I dont know what 6688 is. What do you guys think?

 

[Erbmaster]

Found this m8...

qip-msgd 2468/tcp qip_msgd
qip-msgd 2468/udp qip_msgd
# Mike Morgan <mmorgan@lucent.com>

muse 6888/tcp MUSE
muse 6888/udp MUSE
# Muse Communications Corporation
# <howard@muse3d.com>

Looking at this Lucent.com it may be something to do with ISP software?

Awaits Enyo 😛

 

[scotty588]

i dont have any isp software installed.

 

[vern]

If it's just a personal desktop, I don't see any reason why you should have 80 and 110 open. The 3rd and 4th ports I'm not familiar with, but I have seen IRC servers that sometimes accept connections at 6688 in addition to the normal 6667. They are usually open only for priviledged connections. As for what service might be using these ports ... I'm not even going to speculate.

 

[Xie]

try running a " netstat -a " from command line .. will tell you if your connected to anything on those ports are if they are listening ... also try scanning from out side your router as if your inside your network you will get different results then the "bad guy" outside your router 😉