Port 21 Open

[Ed Greshko]

On 03/05/16 05:40, Richard Ibbotson wrote:
> On Friday 04 March 2016 12:00:55 Joe Zeff wrote:
>> On 03/04/2016 11:44 AM, Tim wrote:
>>> Oh, and just because it's using port 21 doesn't necessarily mean
>>> that it's doing FTP, that's just the recognised common use of the
>>> port.  If you're infiltrated, it could be doing anything.  You,
>>> most likely, need to be more concerned about what process is
>>> using port 60088.
>> It may be a good idea to block both of those ports and see what, if
>> anything, breaks.  In fact, if you're not using the box as an ftp
>> server, the port should be blocked anyway.  (I sometimes ftp to my
>> desktop from my laptop, but I use ftp over ssh, which uses a
>> different port.)
> After some more investigation I find that 195.154.162.172:21 starts up 
> after starting a web browser. Kind of sounds like I'm being tracked. 
> I've checked all of the settings. Can't see anything in the browser 
> that relates to the FTP port. I'll have a look at firewall settings. As 
> far as I know port 21 is blocked.
>
> Strange
>

Are you saying you have control of 195.154.162.172?  That is the system with port 21 open.

You showed...

tcp 0 0 192.168.2.10:60088    195.154.162.172:21

The source port of 192.168.2.10 is 60088 connecting with port 21 on 195.154.162.172.

You could always run "wireshark" or "tcpdump" to examine the traffic between your system
and 195.154.162.172.


-- 
In reality, some people should stick to running Windows and others should stay away from
computers altogether.