RE: Odd identd behavior

> > This looks like the output from an FTP server.  If I had to guess, I would
> > say that this looks like someone compromised a machine and installed a
> > warez ftp server on the identd port.
>
>
> You're right, it does look like that. I didn't even think 
> that it might be a standard service running on a different 
> port.


nmap -sV -p [port] -v is your friend. Nmap service scan will identify the 
service (http, ldap, whatever), the server's name (apache, openldap,..)  and 
version number (to some approximation) very reliably these days. The most 
rrecent version of nmap included lots of new service fingerprints; if it's a 
custom warez server it may still fingerprint as something recognisable, and if 
not, that in itself tells you something.



\a











______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________