Hello All,

i have a little problem into my network segment. I have an exchange server and a Notebook system, where some process tries to ping and connect an external ip adress, located in canada over port 4394/4395.

Do you have an idea? Do you know a worm/exploit/virus which use these ports?

Our virus scanner, newest update, find nothing.

Thanks for your help.

Port 4394 is a common listener port for Oracle 8i. I dont think there're virii or worms using these ports.

Identify unknown open ports and their associated applications
Copyright 2002 © by Foundstone, Inc.
h88p://w8w.foundstone.com

fport supports Windows NT4, Windows 2000 and Windows XP
fport reports all open TCP/IP and UDP ports and maps them to the owning application. This is the same information you would see using the 'netstat -an' command, but it also maps those ports to running processes with the PID, process name and path. Fport can be used to quickly identify unknown open ports and their associated applications.

Usage:


C:\>fport
FPort v2.0 - TCP/IP Process to Port Mapper
Copyright 2000 by Foundstone, Inc.
h88p://w8w.foundstone.com

thanks for the postings ...

i know fport ...but thanks

i think its oracle, ive seen the port before but im not positive if thats it.