Results 1 to 4 of 4

Thread: What is Vettcp UDP/78 and why is ppl so interested about it

  1. #1
    Join Date
    Apr 2003

    Unhappy What is Vettcp UDP/78 and why is ppl so interested about it

    I was looking in my XP firewall log. There is a lot of droped UDP packets from many different IP addresses from all around the world.
    One of the most popular port is 78.

    I googled, searched microsoft.com and this forum, but I only find pages that tell me that port 78 is Vettcp. The only problem is that I have no idea what Vettcp is. So I googled about Vettcp, but only seem to find pages telling me that Vettcp is UPD 78 :P

    Im not to worried about all the dropped packages. I only run TCP/IP network service (no file sharing) and keep the xp patched up.

    But it is very strange that the source IP's are from many different hosts, from many different countries.

    I wonder what is going on...
    Please drop any comments,

    Thank you for reading

  2. #2
    Just a Virtualized Geek MrLinus's Avatar
    Join Date
    Sep 2001
    Redondo Beach, CA
    Boy. Talk about obscure. All I could find was port listing for the most part but I did stumble across:



    Both of these refer to Remote MIB. Perhaps that is why you are getting so many requests. A new form of Remote MIB attack/scan?
    Goodbye, Mittens (1992-2008). My pillow will be cold without your purring beside my head
    Extra! Extra! Get your FREE copy of Insight Newsletter||MsMittens' HomePage

  3. #3
    Jaded Network Admin nebulus200's Avatar
    Join Date
    Jun 2002
    I looked all over the place and could never find a description of exactly what vet is...tcp or udp, although the RFC's (i think they were rfc1700) always had it listed, and in the official one, someone with initials 'cxl1' always initialed it. However, I could never find exactly what it is.

    I looked at the doc's that MsMittens provided and I think they are just describing the rmon protocol for and the vettcp reference is just the MIB info for the RMON protocol:

    "VET TCP"
    ::= { tcp 78,
    udp 78 }
    Interestingly enough...the reference is 'TBD' which I assumes to be determined...maybe it was never formalized but the reserved port remains? The reference would normally supply the RFC number describing it... The description field also in the rest of the MIB's was pretty detailed, but only contains the name...so I am thinking that it probably was never formally defined?

    There is only one constant, one universal, it is the only real truth: causality. Action. Reaction. Cause and effect...There is no escape from it, we are forever slaves to it. Our only hope, our only peace is to understand it, to understand the 'why'. 'Why' is what separates us from them, you from me. 'Why' is the only real social power, without it you are powerless.

    (Merovingian - Matrix Reloaded)

  4. #4
    Join Date
    Apr 2003
    Thx for anwsering

    Maybe port 78 is not widely used, and that is why its hard to google info about it.

    Well no wories, but im still a bit courious if other people get dropped packages on port 78?

    I play on-line games with the pc, and have hosted games, maybe its just gamespy or some other server that lists my pc as a host even if its not at the moment.

    The droped packages is not during gameing tho, I get them as soon as my pc is online.

    Maybe its time to get zone alarm up and running again :P

    I did not do it.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts