port 6621 being probed

I've just started noticing that our router is seeing this -
port 6621 incoming traffic
The port probes are coming from various addresses,
so it seems more like a peer network probe -

I've looked around at the various lists - known & not -
and can't seem to find how or what is probing this port ?

Any ideas ?

On Mon, 05 Jul 2004 19:45:21 GMT, Phil Schuman wrote:
>
> I've looked around at the various lists - known & not -
> and can't seem to find how or what is probing this port ?

nothing handy http://isc.sans.org/port_details.php?port=6621
http://www.dshield.org//port_report.php?port=6621

"Bit Twister" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> On Mon, 05 Jul 2004 19:45:21 GMT, Phil Schuman wrote:
> >
> > I've looked around at the various lists - known & not -
> > and can't seem to find how or what is probing this port ?
>
> nothing handy http://isc.sans.org/port_details.php?port=6621
> http://www.dshield.org//port_report.php?port=6621

tnx - interesting graphs....had not run across these sites -
Looks like the frequency is trending upward for this port 6621 -
Still looking for some comments on what it might be ?

On Mon, 05 Jul 2004 21:52:02 GMT, Phil Schuman wrote:

> tnx - interesting graphs....had not run across these sites -
> Looks like the frequency is trending upward for this port 6621 -

Helps to read the tables, to check the record counts.

http://isc.sans.org/ is a little better read for what's up.

> Still looking for some comments on what it might be ?

Hang on, when more pople get back to work Tuesday you might get more
input.

"Bit Twister" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> On Mon, 05 Jul 2004 21:52:02 GMT, Phil Schuman wrote:
>
> > tnx - interesting graphs....had not run across these sites -
> > Looks like the frequency is trending upward for this port 6621 -
>
> Helps to read the tables, to check the record counts.
>
> http://isc.sans.org/ is a little better read for what's up.
>
> > Still looking for some comments on what it might be ?
>
> Hang on, when more pople get back to work Tuesday you might get more
> input.

You might also try a more appropriate newsgroup. This one is for wireless
data networks. Your problem sounds like malware.

Ron Bandes, CCNP, CTT+, etc.

This could also be something your cable or dsl provider might be doing
for there own maintenance. You say various addresses but are these
addresses in the same subnet or very close?



"Phil Schuman" <(E-Mail Removed)> wrote in message news:<ldiGc.505$(E-Mail Removed) >...
> I've just started noticing that our router is seeing this -
> port 6621 incoming traffic
> The port probes are coming from various addresses,
> so it seems more like a peer network probe -
>
> I've looked around at the various lists - known & not -
> and can't seem to find how or what is probing this port ?
>
> Any ideas ?