attempts to connect to port 1055

hi,

iptraf shows me, that several hosts are trying to access severall ports
on my server. one thing o don't understand:

someone tries to access my port 1055, iptraf shows it like the following:

---

123.123.123.123:7670
my.server:1055

123.123.123.123:7670
192.168.1.139:1055

---

if i browse to 123.123.123.123 with my webbrowser, i get the apache
default website. if i browse to 123.123.123.123:7670 i get sent a file
called z9ofkrw6.bin to my webbrowser.

additionally the same host makes a connection to port 1055 of a machine
inside of my network. i'm not very experienced with linux iptables, so i
don't know whether actually my server is accessed or one of the machines
inside the network or both.

anyone know what this strange .bin file could be?

thanks.
jonas

On Fri, 15 Jul 2005 00:00:38 +0200, Jonas Ryser
<news@jorynet.com> wrote:
> hi,
>
> iptraf shows me, that several hosts are trying to access severall ports
> on my server. one thing o don't understand:
>
> someone tries to access my port 1055, iptraf shows it like the following:
>
> ---
>
> 123.123.123.123:7670
> my.server:1055
>
> 123.123.123.123:7670
> 192.168.1.139:1055
>
> ---
>
> if i browse to 123.123.123.123 with my webbrowser, i get the apache
> default website. if i browse to 123.123.123.123:7670 i get sent a file
> called z9ofkrw6.bin to my webbrowser.
>
> additionally the same host makes a connection to port 1055 of a machine
> inside of my network. i'm not very experienced with linux iptables, so i
> don't know whether actually my server is accessed or one of the machines
> inside the network or both.
>
> anyone know what this strange .bin file could be?
>
file z9ofkrw6.bin
strings z9ofkrw6.bin



--
Tonight you will pay the wages of sin; Don't forget to leave a tip.