12 May
2017
12 May
'17
2:54 p.m.
I'm blocking both TCP and UDP port 16992. I don't think the UDP block
is necessary, as apparently what is on TCP 16992 is an HTTP server of
some sort, but with ipfw it's less work to block both TCP and UDP with
the same rule. I don't know anything about those other ports. (Most of
what I got was obtained by looking through the nmap script description,
not the Intel documents.) At work, so far, they have identified a small
number of exposed hosts, all of which were listening on tcp port 16992,
which they are blocking at the network border.
A 10-second snapshot just now shows 1323 connection attempts to 16992
on amprgw. (That's after excluding anything coming from known shodan
addresses, which are taken care of by an earlier rule.)
- Brian
On Fri, May 12, 2017 at 09:31:33AM +0200, Rob Janssen wrote:
Thanks for the hint. It is surprisingly difficult to
get technical information
from the Intel documents. Do you block TCP only or also UDP? And what about
ports 16993 and 16994? (and maybe even 623 and 664?)