[SLL] OT: Port 3128?

[Anthony Schlemmer]

Can anyone tell me what port 3128 is used for? I've looked in the
/etc/services file and it has the following:

ndl-aas 3128/tcp # Active API Server Port
ndl-aas 3128/udp # Active API Server Port

Is there something special about this service? Over the last few days
I've seen my firewall logging numerious probes against ports 3128 and
8080.

Thanks,

Tony

[Robert Woodcock]

Post by Anthony Schlemmer
Can anyone tell me what port 3128 is used for? I've looked in the
ndl-aas 3128/tcp # Active API Server Port
ndl-aas 3128/udp # Active API Server Port
Is there something special about this service? Over the last few days
I've seen my firewall logging numerious probes against ports 3128 and
8080.

Those scans are almost certainly looking for a squid proxy server.
--
"Certainly what is happening [...] under the Commerce Clause is totally
different than what the Framers had in mind"
-- Supreme Court Justice William Rehnquist

[Ken Caruso]

Its the deafult port for the squid http proxy. People generally scan for
3128 and 8080 as they are common proxy ports, and proxies can be used to
cover the tracks of attacks.

Also if you use irc, alot of irc servers will check these ports on your
machine before letting you connect.

Ken Caruso
***@seattlewireless.net
http://ken.ipl31.net

"when in doubt tell the truth" -Mark Twain

Post by Anthony Schlemmer
Can anyone tell me what port 3128 is used for? I've looked in the
ndl-aas 3128/tcp # Active API Server Port
ndl-aas 3128/udp # Active API Server Port
Is there something special about this service? Over the last few days
I've seen my firewall logging numerious probes against ports 3128 and
8080.
Thanks,
Tony
--
Anthony Schlemmer
It isn't just a good idea, it's the law!
_______________________________________________
http://www.ssc.com/mailman/listinfo/linux-list

[Matt Fisher]

TCP Port 3128 is Squid's default port for it's proxy service.

[Anthony Schlemmer]

Weird that /etc/service files are different on systems as I would have
thought it would be pretty standard by now. I pulled that "ndl-aas"
stuff from my SuSE 8.0 system. Now I know why that port had no meaning
to me as I've never installed or use squid before and under SuSE the
service isn't mentioned as being "squid".

Other weird things I've seen lately are packets coming from port 80 with
a network address of 10.x.x.x. I was surprised as I thought packets
like that would not even be routable to my system. I don't know much
about ATTBI's network and I suppose they might use non-routable
addresses internally or something. My other guess is that it was spoof
attempt vua "nmap". My firewall drops packets from non-routable address
on the floor anyways so it's not a big deal just surprised to see it.

Thanks,

Tony

Post by Matt Fisher
TCP Port 3128 is Squid's default port for it's proxy service.

[Bill Campbell]

Post by Anthony Schlemmer
Weird that /etc/service files are different on systems as I would have
thought it would be pretty standard by now. I pulled that "ndl-aas"
stuff from my SuSE 8.0 system. Now I know why that port had no meaning
to me as I've never installed or use squid before and under SuSE the
service isn't mentioned as being "squid".

For the definitive list of ports see:
http://www.iana.org/assignments/port-numbers

Bill
--
INTERNET: ***@Celestial.COM Bill Campbell; Celestial Software LLC
UUCP: camco!bill PO Box 820; 6641 E. Mercer Way
FAX: [phone] Mercer Island, WA 98040-0820; [phone]
URL: http://www.celestial.com/

``When dealing with any spammer, one must always keep in mind that you
are dealing with someone who makes their living through forgery, fraud,
theft, subterfuge and obfuscation. Stated simply, spammers lie.''
David Ritz <***@primenet.com>