[fw-wiz] UDP 22 & 5632

Anthony DeBoer adb@news.onramp.ca
10 Apr 2000 20:41:39 -0000

Aaron Turner <aturner@vicinity.com> writes:
> I'm seeing a reoccuring pattern where a system will sequentially scan a
> network over and over and over (sometimes for hours) trying to connect to
> UDP 22 & 5632.   ...   It seems to be running on a Windows
> (most likely NT since the IP is in a co-lo) system.

It'd be PC Anywhere, a VNC-ish remote management tool for Windows.  The
client scans what it believes to be the local subnet for PCA servers at
its registered port of UDP/5632.  The UDP/22 business is because the
first version of the product apparently got out the door before they
found out about network byte order; 22 is 5632 backwards.

Anthony DeBoer