Ethereal-users: Re: [Ethereal-users] Soulseek Protocol on Port 1433?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Joerg Mayer <jmayer@xxxxxxxxx>
Date: Tue, 16 Mar 2004 01:38:38 +0100
On Mon, Mar 15, 2004 at 07:14:35PM -0500, Justin Morehouse wrote:
> Thanks for the response. I turned off the dissector, but there is still
> traffic. This lead me to find that they are passing sql statements from port
> 2240 on their lan to port 1433 on their remote sql server. Any idea why this
> might be happening?

In many cases, the official port for the database protocol is only responsible
for dispatching. SQL queries etc are then done via other ports. Or are we
talking about udp packets here? In that case, it might be SQLSlammer worm
(or the regular M$ protocol, that the slammer worm exploited).

 Ciao
        Jörg