Identify Ports for AD - External UDP port scanner

Greetings all,
I am trying to figure out which UDP port is alarming on the "AD - External UDP port scanners (13005)" signature. By default, the signature is set to summarize which looks something like this "NumDestIps=100; currentTHreshold=100. protocol=1".
From the "Protocol = 1" line I am assuming all scanning is hitting up on a single destination protocol - I need to know which protocol / port number.
I've already attempted to turn on "log attacker, pair, and victim" packets. Verbose is not an option for this signature. I have also tried changing alert Frequency to "fire all" or just uncheck the "Summary Mode" box. None of this tells me the destination/victim port. I do see under a protocol field "ICMP" but i don't believe that pertains to the source port. Any ideas on how I might find this information?

TCP/445 is used by Microsoft file sharing (CIFS), and by default that port is opened on all Microsoft PC basically to allow file sharing.
If you open up DOS prompt, and type: netstat -na, you would see that your PC is by default listening on TCP/445.
Here is more information on Microsoft-DS (TCP/445):
http://www.linklogger.com/TCP445.htm
http://en.wikipedia.org/wiki/Server_Message_Block
So it really depends on your corporate security policy, whether to allow file sharing or not within the network. IPS is picking that up because it is an easier way of exploiting a PC since the port is opened by default.

Similar Messages

Creating new logical ports for WSDL with several port types not working

Hi all,
I am trying to integrate some BODS webservice into the BPM. I am using CE 7.2 Kernel Version: 7.20.3710. When I am trying to assign a provider system in the application configuration I get following error:
The provider system successfully found the needed service, but its wsdl is without webservice policy. Thus the generated client configuration might not work because of different configurations between service and client (most probable a difference in the security settings). Either assign a provider system with access to wsdl with policy or manually create the client configuration.
The regarding provider system is using a communication profil where the authentication method is set to "none". Normally this configuration should work, but it isn't.
So I started to create new logical ports for each port type. But then I get the error:
Port type name of loaded WSDL does not match the port type name of the Service Reference.
I checked already the port type names in the WSDL but they are 100% the same. What I found was that the configuration is always trying to use the first port type in the WSDL. So I am not able to configure the other port types in the service group.
I also tried to do the same thing using a WSDL with just one port type and surprise it is working...
I hope somebody can help me out
Thanks in advance
Andy

Hi Andy,
Please check this Link: https://cw.sdn.sap.com/cw/docs/DOC-45012
Regards,
Naresh B

CSS: Mgt port for management vs normal port for Maqnagement

What are the pros and cons of using the ethenet management port for managing a CSS and using a normal ethernet port for managing a CSS.
Is any functionality of CSS depends on Management ethernet port? Is connecting via local lan still an issue/requirement?

you can use whatever port.
People usually wants to use a management port that is *separated* from the rest of the device so that if a regular port gets hacked and somebody gain access to the device, you can't access the management network.
To obtain this separation between regular port and the management port, a lot of restriction have been created on the management port.
You can't configure a default route on the management port, you can't have routes overlapping between management port and regular ports, ...
Therefore, personally, I prefer not to use the management port. The chance that somebody gain access to the CSS via a regular port is almost null so it does not justify the pain to use the management port.
Regards,
Gilles.

Using the USB port for an external HD dumb question

OK. Forgive a possibly really dumb question here...
My external HD has a USB 2.0 interface and I hooked it up to the USB port using a cable that came with an old USB 1 hub I'm not using right now.
My dumb question is this: is there such a thing as a USB 2.0 cable? Or are the USB cables all the same?
Also, how long should it be taking to transfer 12.1 GB of data (about 9,000 photos) from my external HD mounted on the AirMac base station to my MBP? There are still 48 minutes left and it seems an awfully long time for 12.1 GB of data. That's why I was wondering if the cable could be an issue...
Thanks,
doug

I am suspecting now that my HD might really have been a USB 1.0 drive...
doug

When setting the midi port for an external device, how do I stop this altering the port setting for a separate external device?

I am using Logic Pro 9.1.7.
I have an EMU sampler set to port D.
And a Roland JV 2080 set to port B.
The ports refer to an external M-Audio Midisport midi interface.
When creating a new track (brand new, not as a duplicate of another) for sounds from the Roland and setting port B in the Inspector, I find this affects certain existing tracks set to port D that are using sounds from the EMU. The latter tracks are converted to port B. I note that only some, not all, tracks are affected.
If I try to change the EMU tracks back to port D, then the Roland track also switches to port D! And so on...
Each device has a 16-channel "instrument" in the Environment (but no virtual wiring anywhere).
Usually, setting channels, banks and programs in the Event List for each track has been able to make things work reasonably well.
Any suggestions that I could explore would be welcome. Thanks.

I haven't checked this with instrument tracks, could it possibly be you have somehow de-selected Universal Track Mode in Preferences/Audio? It should be enabled.

Which is best port for connecting external pc vga monitor to macbook pro

which is best port to connect my macbook pro to external via monitor?

not sure what you feel your options are most macbooks pro have a minidisplay port or a thunderbolt port which is the same connector
and all minidisplay -> hdmi or dvi or vga works

QOS Network Planning - TCP/UDP Ports used in CWMS 2.5 MDC deployment

Does anyone know if there is documentation that describes the WAN traffic in CWMS 2.5 MDC? I'm looking for the TCP/UDP ports that must be prioritized on the WAN to properly class our traffic between the two data centers. I can't find any such document.
Thanks,
Matt

HI Matt,
All the network requirements are listed in the CWMS 2.5 Planning Guide in Networking Checklist: http://www.cisco.com/c/en/us/td/docs/collaboration/CWMS/2_5/Planning_Guide/Planning_Guide/Planning_Guide_chapter_0100.html
I hope this is what you are looking for.
-Dejan

WRT54GC can't open UDP port

I can't open UPD port i check with PFPortChecker and TCP port is open and UDP port is not reachable i using win7 how to fix it ?

Which port no you are trying to open..?
For which purpose you are openning the port on the router..?
Uncheck "Block Anonymous Internet Requests" under Security tab and check..

Ports for ACS

What ports are need to be open for ACS remote managemet , default port 2002 its clear, but communication than move to 3857 so any others???... Is there any list of required ports????

Hello,
Here is a list with different UDP and TCP ports used by the ACS:
Cisco Secure ACS Ports Usage
Service name - UDP Port
Dynamic Host Configuration Protocol (DHCP) - 68
RADIUS authentication and authorization (original draft RFC) - 1645
RADIUS accounting (original draft RFC) - 1646
RADIUS authentication and authorization (revised RFC) - 1812
RADIUS accounting (original draft RFC) - 1813
Service name - TCP Port
TACACS+ AAA - 49
Replication and RDBM synchronization - 2000
ACS remote logging - 2001
HTTP administrative access (at login) - 2002
ACS distributed logging (appliance only) - 2003
Administrative access (after login)
port range Configurable (default 1024-65535) ACS assigns unique port number from the range to each administration session
Hope this helps! Please rate all posts.
Regards, Martin

Concentrator 3005 ports for router

Hello to ALL,
Something got screwed up here. I need to know which ports should be open on a router that is in front of the concentrator ? ? ?
UDP 4500
TCP 10000
Are these right ?
Please help, thank you

Hi,
IPSec uses the ESP IP protocol (not port) and UDP port 500 (isakmp) and might use the AH IP protocol.
If you use Nat-T then you need UDP port 500 (isakmp) and UDP port 4500 (originally UDP port 10000). With Nat-T there is no need for the ESP and AH protocols.
Regards, Frank

How do I create Labview VISA ports for *individual* GPIB instruments using Prologix USB GPIB controller?

Hello,
I'm trying to use a Prologix USB GPIB controller to control GPIB
instruments, and I would like to have a virtual serial (VISA) port for
*each instrument*, as is the case with a normal GPIB controller with a
standard NI driver. However this is not what the Prologix driver
provides -- it provides a single VISA virtual serial port for the
entire controller. To address the instrument with GPIB address 11,
you first send "++addr 11" to the serial port, and then you're talking
to instrument 11. However, this means I have to change all old
Labview programs.
Is it possible to create a "wrapper" function of some kind that will
define a virtual serial (VISA) port for each *instrument* on the
controller? For example, to talk to GPIB instrument 11, call it
ASRL3::11::INSTR, each time it is written to it would have to write to
the virtual serial port of the controller, say ASRL3::INSTR, first "+
+addr 11" and then the command that is sent to it.
A clearer explanation of the difference (i.e. incompatibility), and of
my objective:
1) A normal GPIB controller with NI driver: I go to the NI
Measurement & Instrumentation Panel, under GPIB, and Scan for
Instruments; all the live instruments show up; subsequently when I
want to use Labview programs that use VISA ports, the VISA drop boxes
allow me to choose a different port for each instrument, e.g.
"GPIB0::11::INSTR", "GPIB0::12::INSTR" would be instruments at
addresses GPIB 11 and GPIB 12.
2) The Prologix GPIB controller that plugs into a USB port: In
Labview you get a *single* VISA virtual serial port, ASRL3::INSTR, for
the entire GPIB0 controller. Therefore to address GPIB instrument 11,
you write "++addr 11" to the virtual serial port ASRL3::INSTR, and
then you are communicating with device 11, so you can write and read
ASRL3::INSTR to talk to that device. Then to talk to device GPIB 12,
you write "++addr 12" to the same VISA port, and then you are talking
to that device. The problem is that this requires recoding all
Labview code, whereas I would like to be able to use the same program
either with a normal or with a Prologix GPIB controller. Therefore, I
would like to create code that scans the controller for all GPIB
attached devices and creates VISA ports for all. Such ports, when
written to, would have to first write "++addr DEVICENUM" to
ASRL3::INSTR (i.e. the port of the GPIB-USB controller) where
DEVICENUM is the GPIB address of the instrument corresponding to that
port, and then would have to do a write or read or whatever function
is being done on that instrument VISA port.
I haven't figured out if it is possible to do this easily. Help and
pointers on where to look for hints would be much appreciated. Many
thanks!
Milos

My first impression is that if you don't want to make any changes at all to existing programs is that the wrapper you need is one around VISA. You would need to intercept all of the calls into the NI VISA driver. If you create your own visa32.dll and in there, change the addressing and then call the real VISA driver, you might (repeat, might) get something to work. If this would even work, you still might find that you have to make significant changes anyway. The serial connection is going to be considerably slower, and interface specific functions such as service request handling, bus triggering of multiple instruments, etc., would be difficult to impossible. This would be a lot of work, imho, to just save a couple of hundred dollars over a real GPIB controller. I've seen this Prologix device before and have even used NI's RS-232->GPIB controller. The Prologix intended use to me seems to me more for a hobbyist or very casual user. Of course, I'm used to having multiple GPIB instruments worth 10s/100s of thousands of dollars and the cost of an fully compliant GPIB controller is just lost in the noise.

Need to setup monitoring aon multiple ports for IDS

I have a cisco 3845. I need to need to setup monitoring aon multiple ports for IDS on 2 ports. How do I do this.
Also,
Is there a way to make ports on the switch portion act like hubs.
Thanks

I assume that you are referring to the Ethernet Switch Module in the 3845. If so it should support SPAN. Here is a SPAN configurations guide:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122limit/122z/122zj15/fz1636nm.htm#1820129

How can I write to port C and read from port A&B simultaneously using 6503 DIO-24

I attempting to read from Port A and B which are grouped together and at the same time I want to write to Port C. The problem I having now is that every time I want to read from Port A and B, Port C seems to be effected. I have only used the easy dio's vi this may be the root of my prblem

Hello,
You will need to use the advanced digital VIs to accomplish what you are trying to do.
The Easy DIO VI's are simply a combination of two DIO advanced VI, so you will use the same two advanced VI with a little different calling method. We want to call both PORT Config VI first to configure two ports for read and one port for write. Then we can simply read and write to the ports as desired, perhaps in a loop.
The best place to start would be to look at the LabVIEW examples for Digital Input and Output operations. In LabVIEW, go to Search Examples then under I/O interfaces select DAQ (or Data Acquisition)-> Digital Input and Output->Immediate Digital Input and Output. From her you will want to look at the examples under the 8255 chip which is the chip on
the DIO-24. I would recommend looking at Read from two digtial ports and the Write to one digital port VI's.
From here you will simply need to combine the two together. One note: you will want to make sure that both port config VI are called before either Port Read or Port Write VIs.

Help sought filtering athe results for an external content type.

I have been using resources like
http://msdn.microsoft.com/en-us/library/office/ee557243(v=office.14).aspx to set up an external content type. Then I used resources such as
http://msdn.microsoft.com/en-us/library/office/ee558778(v=office.14).aspx to create an external list.
I got the infamous error "Unable to display this Web Part..." that web searches show generally happen when too many results are being returned.
When I set up the Read List operation, I did create a limit filter. The column that has a unique value for each record was selected with a default value of 100. The bits I have read seemed to indicate that would limit the results to 100 records. In
my case, what I was attempting to do should have only returned a few records, so that seemed safe.
Since I am getting the error that people indicate is related to too many records being returned, and I looked using powershell and it seems that the default is 2000 items, the limit filter doesn't appear to be working.
I have read books, web blogs, forum threads and technotes. Unfortunately most of what I have read does not really explain _what_ one is supposed to do in a way that is general. Typically it is all done in terms of some specific example, which perhaps I am
not translating into my specific case appropriately.
Can someone explain the filtering and how the functionality works?
Thank you!

Digging into the ULS logs reveals an odd error. It says:
05/06/2014 07:13:11.93 w3wp.exe (NTSRV45SB:0x1E08)
0x0F14
SharePoint Foundation Web Parts
89a1 High
Error while executing web part: System.InvalidOperationException: A null value was used as an Identifier value for Entity (External Content Type) with Name 'HPSM External Data Connection' in Namespace 'http://sandbox/sites/it/projects/sm/hpsm_edc'. Null
identifier values are not permitted. Check the data returned from the LobSystem (External System) or the TypeDescriptors for Method with Name 'PROBSUMMARYM1Read List' on Entity with Name 'HPSM External Data Connection' in Namespace 'http://sandbox/sites/it/projects/sm/hpsm_edc'.
---> System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values. Parameter name: identifierValues at Microsoft.BusinessData.Runtime.Identity..ctor(Object[] identifierValues) at Microso...
532f2966-cc96-4fb8-b0e3-e83b838d2aef
05/06/2014 07:13:11.93* w3wp.exe (NTSRV45SB:0x1E08)
0x0F14
SharePoint Foundation Web Parts
89a1 High
...ft.SharePoint.BusinessData.Infrastructure.CompositeIdentifier.GetIdentity() --- End of inner exception stack trace --- at Microsoft.SharePoint.BusinessData.Infrastructure.CompositeIdentifier.GetIdentity()
at Microsoft.SharePoint.BusinessData.Runtime.AbstractEntityInstance.GetIdentity() at Microsoft.SharePoint.SPExternalList.GetBdcIdentityFromEntityInstance(IEntityInstance entinst) at Microsoft.SharePoint.SPListDataSource.GetFilteredEntityInstancesInternal(XmlDocument
xdQueryView, Boolean fFormatDates, Boolean fUTCToLocal, String firstRowId, Boolean fBackwardsPaging, String& bdcidFirstRow, String& bdcidNextPageRow, List`1& lstColumnNames, Dictionary`2& dictColumnsUsed, List`1& mapRowOrdering, List`1&
lstEntityData) at Microsoft.SharePoint.SPListDataSource.GetFiltered...
532f2966-cc96-4fb8-b0e3-e83b838d2aef
05/06/2014 07:13:11.93* w3wp.exe (NTSRV45SB:0x1E08)
0x0F14
SharePoint Foundation Web Parts
89a1 High
...EntityInstances(XmlDocument xdQueryView, Boolean fFormatDates, Boolean fUTCToLocal, String firstRowId, Boolean fBackwardsPaging, String& bdcidFirstRow, String& bdcidNextPageRow, List`1& lstColumnNames, Dictionary`2& dictColumnsUsed,
List`1& mapRowOrdering, List`1& lstEntityData) at Microsoft.SharePoint.SPListItemCollection.EnsureEntityDataViewAndOrdering(String& bdcidFirstRow, String& bdcidNextPageFirstRow) at Microsoft.SharePoint.SPListItemCollection.EnsureListItemsData()
at Microsoft.SharePoint.SPListItemCollection.get_Count() at Microsoft.SharePoint.WebControls.SPDataSourceView.ExecuteSelect(DataSourceSelectArguments selectArguments, String aggregateString, Boolean wantReturn, BaseXsltListWebPart
webpart, SPListItem& listItem, SPListItemCollection& listItems, String[]& f...
532f2966-cc96-4fb8-b0e3-e83b838d2aef
05/06/2014 07:13:11.93* w3wp.exe (NTSRV45SB:0x1E08)
0x0F14
SharePoint Foundation Web Parts
89a1 High
...ieldList) at Microsoft.SharePoint.WebControls.SingleDataSource.GetXPathNavigatorInternal() at Microsoft.SharePoint.WebControls.SingleDataSource.GetXPathNavigator() at Microsoft.SharePoint.WebPartPages.DataFormWebPart.PrepareAndPerformTransform(Boolean
bDeferExecuteTransform) 532f2966-cc96-4fb8-b0e3-e83b838d2aef
05/06/2014 07:13:11.93 w3wp.exe (NTSRV45SB:0x1E08)
0x0F14
SharePoint Foundation Web Parts
89a2 High
InnerException 1: System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values. Parameter name: identifierValues at Microsoft.BusinessData.Runtime.Identity..ctor(Object[] identifierValues)
at Microsoft.SharePoint.BusinessData.Infrastructure.CompositeIdentifier.GetIdentity()
532f2966-cc96-4fb8-b0e3-e83b838d2aef
So I am thinking this may not be a limit problem at all. However, the Read List operation, right now, has only one filter parameter - on a column that I have verified has no null entries. There are a lot of columns - and a lot of rows. So I set up a limit
filter with a default value of 100, which I thought would limit the number of records returned to 100.
Perhaps the real problem is something different and it only manifests itself as a null value?
Does anyone out there have any ideas?

Ports for External Connection

Hi, i have one problem, i dont know what's ports i need to open in my modem for one user in other network connect in my network. I need to make a NAT for this, but i need to know apple remote port for external connection. And sorry for my english, bad.
thank's.

You need to open TCP and UDP port 3283 and, for ARD 2.0 and later, TCP and UDP port 5900. For encrypted file transfer (ARD 3.x), open TCP port 22. You may also need to open TCP (and perhaps UDP) 5988 and 5989, though it's not clear under what circumstances this will be necessary.
Forum Tip: Since you're new here, you've probably not discovered the Search feature available on every Discussions page, but next time, it might save you time (and everyone else from having to answer the same question multiple times) if you search a couple of ways for a topic, both in the relevant forums, in the User Tips Library and in the Apple Knowledge Base before you post a question.
Regards.

Identify Ports for AD - External UDP port scanner

Similar Messages

Maybe you are looking for