help with unknown port numbers

[zaggy]

I checked my ZA reports and had several port attempts on port 48493. I tried to look up this port but was told the port did not exsist. Why is this? I did a google search and a forum search here and couldn't find that port number anywhere.

If you need to know my OS is win ME unfortunately, LOL.

I appreciate any help. Normally I can find the answers in the forums or on google. This time I am out of places to look.

[chefer]

With a port that high in the ranges, there is no set purpose for it. They are commonly used for virii and assorted trojans, but they aren't noted ports like 25 is to SMTP protocols, and 110 is to POP3 protocols.

With a port scan that high, I'd imagine that someone is looking for a trojan on a range of IPs that they suspect may have been infected with their little bug. All in all I'd not be too concerned. If you are, maybe having someone you know and trust port scan you with Nessus or SAINT. They often times can tell you what is listening on that port, if anything.

Hope this helps.

edit :
if multiple attempts have been made from an IP on that port, then it should likely be reported.

[swarisd]

Since ports below 1024 are considred "Well Known" ports, any port above that are fair game for applications. More than likely you will not find much info on ports above 1024 because any application can use those ports for their own purpose.

I agree with chefer, someone probably is trying to find the machine with a trojan loaded with that port open. It wasn't yours so they went to the next address.

boyam

[t2k2]

Thanks chefer, I benefited from your answer also.

[zaggy]

Thanks so much guys I knew I could count on you when I couldn't find the info anywhere else!

[Unl3Ashed]

48004-48555=Unassigned
This is from the port number list which is attached. ( sorry I forgot from where I've downloaded it )

[SoggyBottom]

Here is a link listing all registered port numbers.

http://www.iana.org/assignments/port-numbers