Re: TCP characteristics of SMTP sessions?

Lars Hecking:
> Now, one thing I find peculiar here is the increasing source port
> number - 1038, 1045, 1057, up to the 2000s and 3000s. As my knowledge
> of TCP/IP is abysmal, I was wondering:

It is a port scanner that collects SMTP greeting banners. TCP
implementations by default increment the local port for each socket.

Wietse

> - has anyone seen the likes before? :)
> - is there anything significant in this port number increase, i.e.
> can it be attributed to a known piece of malware on the connecting
> client, or would ordinary, standard mail clients exhibit the same
> characteristic (for consecutive smtp sessions)?
>
> Thanks :)
>
>
>