[fw-wiz] UDP 22 & 5632
10 Apr 2000 20:41:39 -0000
Aaron Turner <email@example.com> writes:
> I'm seeing a reoccuring pattern where a system will sequentially scan a
> network over and over and over (sometimes for hours) trying to connect to
> UDP 22 & 5632. ... It seems to be running on a Windows
> (most likely NT since the IP is in a co-lo) system.
It'd be PC Anywhere, a VNC-ish remote management tool for Windows. The
client scans what it believes to be the local subnet for PCA servers at
its registered port of UDP/5632. The UDP/22 business is because the
first version of the product apparently got out the door before they
found out about network byte order; 22 is 5632 backwards.