Port 4000 help

[xraystan]

I wasn't too sure where to put this, so I guess the network area is as good as any.

Anyway, does anyone know what ports 4000, 4001 and 4003 are for?
Last night my cable modem went mental and I couldn't get any internet access.
My zonealarm pro log showed an entry for these ports from the same ip address 210.51.226.250.
Any ideas?
I've tried searching for any info on these ports and nobody seems to publish anything on them.
Now I a bit stuck.

[tekfrost]

Hey there, Though almost anything COULD use those ports or scan your puter at those port you might want to check out this trogen. Pysber Streaming Server, it useing those port by default. Though I really don't don't know what was going on with your puter when it was actin funny.

Peace out

[petemcevoy]

Only thing i've heard of for that port is MUD's - multi user domains.
You should try to contact the owner of that block of addresses - maybe this will help: http://www.samspade.org/t/ipwhois?a=210.51.226.250

[dcongram]

Port 4000 is ICQ default

[xraystan]

Thanks for the pointers on this one fellas.
I've checked out the Psyber Streaming Server and it doesn't look like it is the cause of my problems.
However I always say unless you are 100% certain, don't rule anything out. So needless to say I'll be keeping an eye out for this one.
I don't have any ICQ installed on my PC, so I think I can rule this one out, can't I?
Anyway I used the link petemcevoy provided and it looks like it's sourced somewhere in China.
I'll be keeping a record of the results produced, so if it happens again I'll know where to start.

Edited for updated info...

Just after I had posted my original reply my the results from a trace started at visualroute.visualware.co.uk came back.

Here is what it said..

inetnum: 210.51.226.240 - 210.51.226.255
netname: JINGYE-INTERNET-BAR
descr: Taizhou linhai Jingye Internet Bar.
descr: Taizhou,Zhejiang province
country: CN
admin-c: TC254-AP
tech-c: TC254-AP
mnt-by: MAINT-CN-ZM28
changed: zhaoyp1@china-netcom.com 20010918
source: APNIC

Bugger, bloody internet cafes, doncha just love 'em

[K-Line]

I use a program from Foundstone, called FPort. It tells you which TCP/UDP ports are open, and which programs are using them.

I use Windows 2000, so I'm not sure if it will work with whichever OS you're using.

http://www.foundstone.com/rdlabs/ter...me=FPortNG.zip

Hope this is some help.

K-Line

[Tedob1]

port 4000 is a port for remote control devices. its used by the SDK trojan aka. skydancer whice allows access to all you registry settings.

whats with these china guys...why do we let them get away with anything they want..sadmind, code red, nimda.this sh*t.

[Ghost_25inf]

port 4001 or 2001 or 6001 tcp is a cisco-mgmt port sounds to me like some one is trying to get into your cisco or seeing if you have it.

4045 is nfs-lockd

and if you are running cisco look for this port 9001 thats your xremote.
check out www.hackingexposed.com for more port info or pick the book up at any good book store.

[jcdux]

Originally posted by petemcevoy
Only thing i've heard of for that port is MUD's - multi user domains.

MUD's are Multi-User Dungeon's not domains.

J.

[petemcevoy]

Wrong - its quite ambiguous - dungeons/domains/dialogues/dimensions.

Nice try though.