is one of my hosts a scanner?

[Lawrence Sica]

On Tuesday, September 9, 2003, at 11:25  AM, Randy Bush wrote:

>>> seq     my host                       victim(s)
>>> ---     ----------------              ---------------
>>> 24)     192.168.0.2:1121    <-->      216.52.3.2:2703
>>> 25)     192.168.0.2:1122    <-->      216.52.3.4:2703
>>> 39)     192.168.0.2:1124    <-->      216.52.3.2:2703
>>
>> Those hosts are at cloudmark.com, which gets used by
>> spamassassin (or some part of it).  Port 2703 is Razor2
>> <http://www.sng.ecs.soton.ac.uk/cgi-bin/faq?_recurse=1&file=16> - so
>> that fits as well.
>
> <doh!>  thanks.
>
> so tell me, why does the iana think port 2703 is sms-chat?  i.e.,
> why is the port used by razor2 not properly registered as a well
> known port?
>



Maybe razor2 is using the port without checking if it was already 
assigned for sms-chat?
IANA doesn't automagically know who uses what port unless someone tells 
them I thought.

--Larry