[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[cobalt-users] [RaQ 2] increase in odd port connections reported.



Greetings,
I have a RaQ2, with about 14 sites on it.
It's behind a firewall that logs all inbound and outbound
connections, listing the service or port number.
I printed the outgoing log and noticed a high number of unassigned
Ports my RaQ is trying to connect to. Most of the connections
Are going out to IP addresses.
Could this be a sign of a compromised server?
I've listed a few below.
Internal Lan IP         External IP        Port/Service
192.168.1.243           66.196.72.20         50542
Ditto                   66.196.65.34         34328
Ditto   ip-69-33-19-140.iad.megapath.net     39947

The list is extensive, and the ports are all unassigned.

Other ports it's trying to go out to are:
3998
2273
58529
39939
3903
4488
2130
1821
3557

So here I'm stuck, is it possible that one of the sites are 
Making calls to these addresses? Could it be Mail related?

Thanks for any help.
Carlie Bentley