Security

Ask something
Discussion Locked

Network Blackjack in Firewall logs

0 helpful
5 replies

by jeff3453

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

In our Checkpoint Firewall 1/VPN 1 logs there are entries for a service called "Blackjack". This is coming from most of our computers. I found in a port list that this service uses port 1025. Does anyone know what this is, how is it being generated?

Thanks.

5 replies

by stillatit

Either someone at your site downloaded it and shared, or it came in on a CD, like the MS entertainment pack.

In any case, if you don't like it, block the port, and see which of your users complains. Then ask that user exactly what he is running, and where it came from.

Good luck.

by some guy in seattle

If this is defined as the source port of your client machines, I wouldn't worry too much about it. Most TCP/IP stacks won't source a connection from one of the "well-known" ports (0-1023), but many (typically Microsoft OS) will begin their port sourcing immediately above that.

To give an example, boot a MS machine onto a network and start some web connections. Then, from a command prompt, type "netstat -an". In the local address column you will see your IP, a colon, then a port number. Odds are it's somewhere near to 1024-1030.

You'll really have to worry about users gambling on the network when blackjack is the destination port. :)

Hope that helps,

This discussion is closed to new replies.