Windows Server - What is Port 31665?

Asked By Brandon

13-Aug-07 11:25 AM

After a series of many failed login attempts on our server using various
seem to find out what this port is . . . or does it matter?  I'm just trying
to figure out if this should be a concern.

--
Brandon

13-Aug-07 11:54 AM

Hi,
Thats a high port number, normally what happens in a tcp handshake is
that the remote party connects to the remote host on the port number
assigned to the program, eg 23 for telnet, 25 for smtp etc, in doing
this it selects its own local high port to use (above 1023) are you sure
you are reading the logs correctly ? Also where are you seeing these
errors logged.
simon

13-Aug-07 12:13 PM

In the security event log is where I'm finding the failed logins using
still trying to determine if I'm reading the success logins (immediately
following the failed logins) correctly.

--
Brandon

13-Aug-07 04:18 PM

Always be concerned unless you know otherwise.

A high port like this would normally be used for listening by a
process which doesn't have admin privileges, i.e. not a normal
Windows service. Various games and malware tend to listen on
ports this high.

Try netstat -an at a command prompt, which ought to show you what
is listening on the port. Also try to telnet to it, on the offchance
it might return a helpful banner, or at least confirm something
really is listening there.

14-Aug-07 05:18 PM

Brandon> After a series of many failed login attempts on our
Brandon> server using various "high" port numbers, I find a
Brandon> successful login on port 31665, but I can't seem to find
Brandon> out what this port is . . . or does it matter?  I'm just
Brandon> trying to figure out if this should be a concern.

Can you determine the source of these failed login attempts from the
log messages?  This may be an indication of a compromised computer or
a malicious (trusted) user on your internal network.  It's worth
further investigation.

To determine which process is listening on that service port, you can
use the "-b" option to NETSTAT.EXE.

It's strange that your log messages do not include the name of the
application or service that's generating the log entries.

Best wishes,
Matthew

--
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

14-Aug-07 06:48 PM

What is presently listening on port 31665?  Type this command line:
netstat -ano | find "31665"
If there are no results,  then nothing is listening on that port.


Is 31665 a known port?  Look here:
http://www.portforward.com/cports.htm