While working at a customer site (a LAN that includes several Windows machines, plus our server) I noticed that something was periodically attempting to connect to our server on port 23 via TCP.
Nobody at that site even knows what telnet is, let alone how to run it, so I can probably rule out a human being trying to deliberately telnet in. Plus it appears to happen on a regular basis, around the clock.
So the question is, is there any known/legitimate reason for these attempts to occur? (e.g. is Windows doing some kind of network scan or something)? Or is this likely to be a sign of the presence of some sort of malware on the LAN?