Printable View
I wasn't too sure where to put this, so I guess the network area is as good as any.
Anyway, does anyone know what ports 4000, 4001 and 4003 are for?
Last night my cable modem went mental and I couldn't get any internet access.
My zonealarm pro log showed an entry for these ports from the same ip address 210.51.226.250.
Any ideas?
I've tried searching for any info on these ports and nobody seems to publish anything on them.
Now I a bit stuck.:what:
Hey there, Though almost anything COULD use those ports or scan your puter at those port you might want to check out this trogen. Pysber Streaming Server, it useing those port by default. Though I really don't don't know what was going on with your puter when it was actin funny.
Peace out
Only thing i've heard of for that port is MUD's - multi user domains.
You should try to contact the owner of that block of addresses - maybe this will help: http://www.samspade.org/t/ipwhois?a=210.51.226.250
Port 4000 is ICQ default
Thanks for the pointers on this one fellas.:thumbsup:
I've checked out the Psyber Streaming Server and it doesn't look like it is the cause of my problems.
However I always say unless you are 100% certain, don't rule anything out. So needless to say I'll be keeping an eye out for this one.:wow:
I don't have any ICQ installed on my PC, so I think I can rule this one out, can't I?
Anyway I used the link petemcevoy provided and it looks like it's sourced somewhere in China.
I'll be keeping a record of the results produced, so if it happens again I'll know where to start.
Edited for updated info...
Just after I had posted my original reply my the results from a trace started at visualroute.visualware.co.uk came back.
Here is what it said..
inetnum: 210.51.226.240 - 210.51.226.255
netname: JINGYE-INTERNET-BAR
descr: Taizhou linhai Jingye Internet Bar.
descr: Taizhou,Zhejiang province
country: CN
admin-c: TC254-AP
tech-c: TC254-AP
mnt-by: MAINT-CN-ZM28
changed: [email protected] 20010918
source: APNIC
Bugger, bloody internet cafes, doncha just love 'em
I use a program from Foundstone, called FPort. It tells you which TCP/UDP ports are open, and which programs are using them.
I use Windows 2000, so I'm not sure if it will work with whichever OS you're using.
http://www.foundstone.com/rdlabs/ter...me=FPortNG.zip
Hope this is some help. :)
K-Line
port 4000 is a port for remote control devices. its used by the SDK trojan aka. skydancer whice allows access to all you registry settings.
whats with these china guys...why do we let them get away with anything they want..sadmind, code red, nimda.this sh*t.
port 4001 or 2001 or 6001 tcp is a cisco-mgmt port sounds to me like some one is trying to get into your cisco or seeing if you have it.
4045 is nfs-lockd
and if you are running cisco look for this port 9001 thats your xremote.
check out www.hackingexposed.com for more port info or pick the book up at any good book store.
MUD's are Multi-User Dungeon's not domains.Quote:
Originally posted by petemcevoy
Only thing i've heard of for that port is MUD's - multi user domains.
J.
:p
Wrong - its quite ambiguous - dungeons/domains/dialogues/dimensions.
Nice try though.
Do you play Diablo II? I believe that uses port 4000 and a few others.
If you do play, take a look at blizzard.com/support/Diablo2exp (I think) and see what their port range is.
Actually - here you go:
----------------------------------------
Blizzard Entertainment does NOT directly support proxies or other Internet sharing software. Due to the large number of proxy solutions available, results from using Internet sharing software/hardware in combination with Blizzard Entertainment products may vary.
The Blizzard Entertainment Technical Support staff will NOT be able to help with proxy, router, or firewall issues.
Battle.net is now "NAT Friendly" and the Blizzard Entertainment games should work fine with most NAT implementations without ANY special settings. If you are behind a firewall you will have to open port 6112 and set it to receive inbound and outbound UDP and TCP packets. Unpatched versions of Diablo will also use port 116 and 118 for TCP/IP traffic. Diablo II users must additionally have port 4000 open for TCP/IP traffic.
Hosting/Playing a TCP/IP game (not on Battle.net):
In your Proxy/Firewall software, be sure port 4000 is open to send and receive TCP packets.
Hosting/Playing a game on Battle.net:
You must open port 6112 through port 6119, and 4000 to receive inbound and outbound TCP and UDP packets in your Proxy/Firewall software.
Although players behind a proxy server or IP-sharing software can join Open Battle.net and Open Internet TCP/IP games, when such players create games, others may not be able to join them. If this problem presents itself, then players using a proxy server should request that another player creates the game.
The reason for this problem involves the difference between external (internet) IP address, and internal (LAN) IP address. Because proxy users do not have an external IP address, they cannot have a direct link to other players who do have an external address. The host of an Open Battle.net or Open TCP/IP game must have a direct link to each player in the game - therefore, players will not be able to connect to a game created by a proxy user.
Blizzard doesn't specifically support proxy servers. If you really want to host a game on your server computer, then you can disable the proxy temporarily. That'll let you host a game that can be joined by people from across the internet (and Diablo should display your external IP address), but such a game probably can't be joined by others on the your LAN (since the LAN computers, now cut off from their proxy, can only see internal IP addresses).
One last note:
Although proxy users will have trouble hosting internet games from behind a proxy server, they won't have any trouble joining an internet game. If proxy users want to play a game with some people on their LAN, as well as some people across the internet, then one of the players across the internet should host; preferably someone with a lot of RAM.
--------------------------------------
~N~
hehe hey da best place to hack/crack is on internet cafes at night.. hehe
i hope u hv a av running... otherwise u may hv a trojan running, e.g. sub7 able to dynamically selects ports to use, so it may be 4000 this time and something else later... i hope this is not happening to u...
rgds
de