ports questions

[stemy]

I just imstalled norton internet security and configured it to prompt on each ip accessing my computer. I noticed that ricky attemps come from three ports:
1. 1214 - I know that KaZaA listenes on that port but it seems still open after I close KaZaA.
2. 4662 - I have no idea what it's used for.
3. 1122 (don;t know that one too).

any idea or tip would be great.

 

[RiezalR]

Here is a link to a reference of which services belongs to which ports. However, do keep in mind that not all ports actually belong to the referenced service. It might be some other program using the same port.

http://www.iana.org/assignments/port-numbers

 

[SgtB]

Think about what you need access to. Internet access for example is 80-http; FTP access 21-ftp; SMTP 25-smtp. Just a few examples (Do you get the naming convention of ports now? If not its the port number, and the protocol name)
What you should typically do is close everything, then open the ports you need. What kind of access do you or your company need to the internet?

PS - For your reading pleasure. IANA's officail list of port names/numbers.

http://www.iana.org/assignments/port-numbers

________________________________________
Check out

http://www.security-forums.com

 

[pansophic]

Knowing that ports are open is of little use unless you know WHY the port is open. Ephemeral ports (those above 1023) are used for outgoing connections and are dynamically assigned by the OS. Therefore it is entirely possible that these ports are open and connected to port 80 on another machine. That would mean that these ports are open for a Web session and it would be completely normal and not a security risk.

Windows generally uses the ephemeral ports 1024 - 5000 for its outgoing connections, while unix will use anything upto 65535.

If you see that ports are open, run netstat to see why the connections were created. If you see something listening on a port, then you need to start worrying.
pansophic