Which ports do TCP protocol need to use? What network service?

Port: 1

Service: tcpmux

Description: This means that someone is looking for sgi irix machine. Irix is the main provider of tcpmux, which is turned on by default in this system. Irix machine contains several default password-free accounts when it is released, such as ip, guest uucp, nuucp, demos, tutor, diag, outofbox, etc. Many administrators forget to delete these accounts after installation. So hackers searched for tcpmux online and used these accounts.

Port: 7

Service: echo

Description: When searching for fraggle amplifier, you can see many messages sent by people to x.x.x.0 and x.x.x.255.

Port: 19

Service: Character Generator

Description: This is a service that only sends characters. The udp version will respond to packets containing * * characters after receiving udp packets. When tcp connects, it sends a data stream containing * * characters until the connection is closed. Hackers can use ip spoofing to launch dos attacks. Forge udp packets between two chargen servers. Similarly, the fraggle dos attack will broadcast a packet with a forged victim ip to this port of the target address, and the victim will be overloaded in response to the data.

Port: 2 1

Service: ftp

Description: ftp server opens ports for uploading and downloading. The most common attacker is to find a way to open anonymous's ftp server. These servers have read-write directories. Trojan doly Trojan, fore, Stealth ftp, webex, wincrash, blade runner open ports.

Port: 22

Service: ssh

Description: The connection between tcp established by pcanywhere and this port may be to find ssh. This service has many weaknesses. If configured in a specific mode, many versions that use the rsaref library will have many loopholes.

Port: 23

Service: telnet

Description: Remote login, the intruder is searching for the service of remote login unix. In most cases, scanning this port is to find the operating system running on the machine. And using other technologies, intruders will also find the password. Trojan mini telnet server opens this port.

Port: 25

Service: smtp

Description: The port opened by smtp server is used to send mail. Intruders are looking for smtp servers to send their spam. The intruder's account is closed, and they need to connect to a high-bandwidth email server and send simple information to different addresses. Trojan horse antigen, e-mail password sender, haebu coceda, shtrilitz stealth, winpc and winspy all open this port.

Port: 3 1

Service: message authentication

Description: Trojan Master Park and Hacker Park open this port.

Port: 42

Service: wins replication

Description: wins replication

Port: 53

Service: Domain Name Server (dns)

Description: For the port opened by dns server, intruders may try to pass tcp, cheat dns(udp) or hide other communication. Therefore, firewalls usually filter or record this port.

Port: 67

Service: Boot Protocol Server

Description: A large amount of data sent to the broadcast address 255.255.255.255 is often seen through the firewall of dsl and cable modem. These machines are requesting addresses from the dhcp server. Hackers often enter them, assign an address and use themselves as local routers to launch a large number of man-in-the-middle attacks. The client broadcasts the requested configuration to port 68 and the server broadcasts the response request to port 67. This response is broadcast because the client does not know the ip address that can be sent.

Port: 69

Service: cumbersome file transfer

Description: Many servers provide this service together with bootp, so it is convenient to download the startup code from the system. However, they often allow intruders to steal any files from the system due to configuration errors. They can also be used for system writing files.

Port: 79

Service: finger server

Description: Intruders are used to obtain user information, query the operating system, detect known buffer overflow errors, and respond to finger scanning from their own machines to other machines.

Port: 80

Service: service. This is similar to the function of UNIX11port. Services using dcom and rpc register their locations with the endpoint mapper on the computer. When remote customers connect to their computers, they will look for the location where the endpoint mapper finds the service. Will a hacker scan this port of a computer to find the exchange server running on this computer? What version? There are also some dos attacks on this port.

Ports: 137, 138, 139

Service: netbios name service

Note: Among them, 137 and 138 are udp ports, which are used when transmitting files through network neighbors. And port 139: the connection coming through this port attempts to obtain netbios/smb service. This protocol is used for windows file and printer sharing and samba. Wins regisrtation also uses it.

Port: 143

Service: Temporary Mail Access Protocol v2.

Description: Like the security problem of pop3, many imap servers have buffer overflow vulnerabilities. Remember: linux worms (admv0rm) will spread through this port, so many scans of this port come from uninformed infected users. These vulnerabilities became popular when redhat allowed imap by default in its linux distribution. This port is also used for imap2, but it is not popular.

Port: 16 1

Service: snmp

Description: snmp allows remote management of devices. All configuration and operation information is stored in the database and can be obtained through snmp. Many administrators' misconfigurations will be exposed online. Cackers will try to access the system using the default passwords public and private. They will try all possible combinations. Snmp packets may be incorrectly pointed to the user's network.

Port: 177

Service: X Display Manager Control Protocol

Description: Many intruders access the X-Windows console through it, and it needs to open 6000 ports at the same time.

Port: 389

Services: ldap, ils

Description: Lightweight Directory Access Protocol and NetMeeting Internet Locator server * * * use this port.

Port: 443

Service: mon internet file system (cifs) (public internet file system)

Port: 464

Description: kerberos kpasswd(v5). In addition, port 464 of tcp is also used for this purpose.

Port: 500

Description: Internet Key Exchange (ike) (Internet Key Exchange)