Port 6000

Unsure where this belongs....

We noticed in our hardware logs that we were getting many port 6000 and 6001
entries. Read somewhere that it's related to X-Windows but we have no Linux
except a couple of servers. But the requests are coming from or Windows
machines [100+ Win XP plus a dozen Server 2003 servers].

Ideas? Normal?

Thanks

 

On 04/17/09 12:56, Gis Bun wrote:
> We noticed in our hardware logs that we were getting many port 6000
> and 6001 entries. Read somewhere that it's related to X-Windows but
> we have no Linux except a couple of servers. But the requests are
> coming from or Windows machines [100+ Win XP plus a dozen Server 2003
> servers].

X-Windows can use ports 6000 and 6001. However any thing that runs
X-Windows can do that, not just Linux. So if you have any unix systems
they could be doing it too. But seeing as how the connections are
originating from the XP systems...

> Ideas? Normal?

Can you predict when it will happen?

Does the connection originate on port 6000 / 6001 or does it originate
elsewhere and go to port 6000 / 6001?

What do you see on one of the systems that is sending the packets if you
run the following command:

netstat -ano

The "o" tells netstat to show the PID of the process binding to said
port. Then look at Task Manager and see what the process name is and
see if you can't track things down a bit more with that information.

I will say that port 6000 / 6001 is fairly high up there (as far as well
known services) and may be an arbitrarily used range by some network
application that you have installed.



Grant. . . .

 

"Grant Taylor" <gtaylor@riverviewtech.net> wrote in message
news:gsaqou$5aa$1@tranq7.tranquility.net...
> X-Windows can use ports 6000 and 6001. However any thing that runs
> X-Windows can do that, not just Linux. So if you have any unix systems
> they could be doing it too. But seeing as how the connections are
> originating from the XP systems...
>
>> Ideas? Normal?
>
> Can you predict when it will happen?
>
> Does the connection originate on port 6000 / 6001 or does it originate
> elsewhere and go to port 6000 / 6001?
>
> What do you see on one of the systems that is sending the packets if you
> run the following command:
>
> netstat -ano
>
> The "o" tells netstat to show the PID of the process binding to said port.
> Then look at Task Manager and see what the process name is and see if you
> can't track things down a bit more with that information.
>
> I will say that port 6000 / 6001 is fairly high up there (as far as well
> known services) and may be an arbitrarily used range by some network
> application that you have installed.
>
>
>
> Grant. . . .

Grant,

Don't those ports sound like Bitorrent ports?

To the original poster - are any machines running any kind of file sharing
programs (lime wire, kaasa, etc)? Once you've ran a netstat -ano, it should
indicate what they are, that is if you can catch them. If you have a traffic
sniffer, you can filter and capture traffic on those ports and see what
their source and destination are.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
aceman@mvps.RemoveThisPart.org

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

 

> Grant,
>
> Don't those ports sound like Bitorrent ports?
>
> To the original poster - are any machines running any kind of file sharing
> programs (lime wire, kaasa, etc)? Once you've ran a netstat -ano, it should
> indicate what they are, that is if you can catch them. If you have a traffic
> sniffer, you can filter and capture traffic on those ports and see what
> their source and destination are.

We are not getting bandwidth consumption. Seems to be more like a "checking
in".

Gis

 

"Grant Taylor" wrote:

> On 04/17/09 12:56, Gis Bun wrote:
> > We noticed in our hardware logs that we were getting many port 6000
> > and 6001 entries. Read somewhere that it's related to X-Windows but
> > we have no Linux except a couple of servers. But the requests are
> > coming from or Windows machines [100+ Win XP plus a dozen Server 2003
> > servers].
>
> X-Windows can use ports 6000 and 6001. However any thing that runs
> X-Windows can do that, not just Linux. So if you have any unix systems
> they could be doing it too. But seeing as how the connections are
> originating from the XP systems...

> > Ideas? Normal?
>
> Can you predict when it will happen?
>
> Does the connection originate on port 6000 / 6001 or does it originate
> elsewhere and go to port 6000 / 6001?
>
> What do you see on one of the systems that is sending the packets if you
> run the following command:
>
> netstat -ano
>
> The "o" tells netstat to show the PID of the process binding to said
> port. Then look at Task Manager and see what the process name is and
> see if you can't track things down a bit more with that information.
>
> I will say that port 6000 / 6001 is fairly high up there (as far as well
> known services) and may be an arbitrarily used range by some network
> application that you have installed.
>
>
>
> Grant. . . .
>
Thanks. Let me get back to you on your suggestions....

Gis

 

OK. It seems that Avast servers also use port 6000. Case solved.

"Gis Bun" wrote:

>
>
> "Grant Taylor" wrote:
>
> > On 04/17/09 12:56, Gis Bun wrote:
> > > We noticed in our hardware logs that we were getting many port 6000
> > > and 6001 entries. Read somewhere that it's related to X-Windows but
> > > we have no Linux except a couple of servers. But the requests are
> > > coming from or Windows machines [100+ Win XP plus a dozen Server 2003
> > > servers].
> >
> > X-Windows can use ports 6000 and 6001. However any thing that runs
> > X-Windows can do that, not just Linux. So if you have any unix systems
> > they could be doing it too. But seeing as how the connections are
> > originating from the XP systems...
>
> > > Ideas? Normal?
> >
> > Can you predict when it will happen?
> >
> > Does the connection originate on port 6000 / 6001 or does it originate
> > elsewhere and go to port 6000 / 6001?
> >
> > What do you see on one of the systems that is sending the packets if you
> > run the following command:
> >
> > netstat -ano
> >
> > The "o" tells netstat to show the PID of the process binding to said
> > port. Then look at Task Manager and see what the process name is and
> > see if you can't track things down a bit more with that information.
> >
> > I will say that port 6000 / 6001 is fairly high up there (as far as well
> > known services) and may be an arbitrarily used range by some network
> > application that you have installed.
> >
> >
> >
> > Grant. . . .
> >
> Thanks. Let me get back to you on your suggestions....
>
> Gis
>

 

"Gis Bun" <GisBun@discussions.microsoft.com> wrote in message
news:E8AABC44-4632-4A46-908E-ED4015D87E06@microsoft.com...
>
> OK. It seems that Avast servers also use port 6000. Case solved.
>


Avast? I'll have to remember that.

Good to hear you've figured it out!

Ace

 

"Ace Fekay [Microsoft Certified Trainer]" wrote:

> "Gis Bun" <GisBun@discussions.microsoft.com> wrote in message
> news:E8AABC44-4632-4A46-908E-ED4015D87E06@microsoft.com...
> >
> > OK. It seems that Avast servers also use port 6000. Case solved.
> >
>
>
> Avast? I'll have to remember that.
>
> Good to hear you've figured it out!

Yup. They still store stuff in an INI file [at least for the managed
clients]. Couldn't find anything in the server console but the client's INI
mentioned port 6000 which is for discovering new clients - it seems.

 

"Gis Bun" <GisBun@discussions.microsoft.com> wrote in message
news:9932B9B9-956B-481D-BCD0-283DD413958F@microsoft.com...
>
> Yup. They still store stuff in an INI file [at least for the managed
> clients]. Couldn't find anything in the server console but the client's
> INI
> mentioned port 6000 which is for discovering new clients - it seems.
>


Interesting. I haven't used Avast, but it is good to know if I ever get a
customer that does use it.

Cheers!

Ace