1

While working at a customer site (a LAN that includes several Windows machines, plus our server) I noticed that something was periodically attempting to connect to our server on port 23 via TCP.

Nobody at that site even knows what telnet is, let alone how to run it, so I can probably rule out a human being trying to deliberately telnet in. Plus it appears to happen on a regular basis, around the clock.

So the question is, is there any known/legitimate reason for these attempts to occur? (e.g. is Windows doing some kind of network scan or something)? Or is this likely to be a sign of the presence of some sort of malware on the LAN?

1
  • How did you see the connection attempts and not record the source IP address, anyway? My money is on something like a "Wavelink Mobile Manager" or a "Spiceworks"... Let us know how it turns out. Sep 3, 2009 at 23:57

3 Answers 3

2

There are very few legitimate uses of Telnet these days; it's definitely not something that should be enabled unless you need it.

As joeqwerty says, get some details of where the connection requests are coming from, and what's actually happening.

1

Was it an actual connection attempt or was it the server listening on port 23 for incoming connections because the Telnet service is running?

Did you run a netstat or packet capture to get any details? If not, that would be my next step.

1

If you watch the traffic on an internet connected system you will see constant scans of commonly vulnerable ports (telnet, ssh, ftp, netbios etc) by automated scripts looking for new targets.

If you actually have something listening on telnet or ssh ports then you can expect to be hit with brute-force password guessing attempts.

This is normal, unfortunately, and seeing this sort of traffic usually means you have noticed something that was always there.

On the otherhand, if the telnet connections are coming from within your network you need to track that down to see if the source is an infected system; you can't clean up the entire internet, but you can clean up your little corner of it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .