Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

While working at a customer site (a LAN that includes several Windows machines, plus our server) I noticed that something was periodically attempting to connect to our server on port 23 via TCP.

Nobody at that site even knows what telnet is, let alone how to run it, so I can probably rule out a human being trying to deliberately telnet in. Plus it appears to happen on a regular basis, around the clock.

So the question is, is there any known/legitimate reason for these attempts to occur? (e.g. is Windows doing some kind of network scan or something)? Or is this likely to be a sign of the presence of some sort of malware on the LAN?

share|improve this question
    
How did you see the connection attempts and not record the source IP address, anyway? My money is on something like a "Wavelink Mobile Manager" or a "Spiceworks"... Let us know how it turns out. –  Evan Anderson Sep 3 '09 at 23:57

3 Answers 3

There are very few legitimate uses of Telnet these days; it's definitely not something that should be enabled unless you need it.

As joeqwerty says, get some details of where the connection requests are coming from, and what's actually happening.

share|improve this answer

Was it an actual connection attempt or was it the server listening on port 23 for incoming connections because the Telnet service is running?

Did you run a netstat or packet capture to get any details? If not, that would be my next step.

share|improve this answer

If you watch the traffic on an internet connected system you will see constant scans of commonly vulnerable ports (telnet, ssh, ftp, netbios etc) by automated scripts looking for new targets.

If you actually have something listening on telnet or ssh ports then you can expect to be hit with brute-force password guessing attempts.

This is normal, unfortunately, and seeing this sort of traffic usually means you have noticed something that was always there.

On the otherhand, if the telnet connections are coming from within your network you need to track that down to see if the source is an infected system; you can't clean up the entire internet, but you can clean up your little corner of it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.