🚀 go-pugleaf

Alan and Pieter,

	Thank you for your comments.
	Then, packet to 635/tcp is an attempt to attack Linx mount
	service, right ?

	BTW, http://www.isi.edu/in-notes/iana/assignments/port-numbers
	says port 635/tcp, udp is for RLZ DBase.

  Regards,
  Toshio Kumagai

  ###

Alan J Rosenthal wrote:
> 
  <snip!>
> 
> Nfsd is at port 2049 (2049/udp for NFS2, 2049/tcp for NFS3).  You should block
> this port number at your organizational gateway (both udp & tcp).
> 
> Mountd, unfortunately, is not at a well-known port number.  Instead, the
> client contacts the "portmapper" at port 111 (which you should also block at
> your organizational gateway), and the portmapper replies with the real port
> number, and the client then contacts the real daemon.
> 
> However, linux fixes mountd at port 635.  This is a very good thing.  It is
> completely compatible with other NFS implementations (you always go through
> the portmapper, and no one is going to notice or care that in linux it
> returns a constant for mountd rather than a slightly varying number), and
> unlike with the other mountd implementations this fixed port number is easily
> filtered out at your organizational gateway (which you should also do, unless
> you have no linux machines and also have a crystal ball which would warn you
> if anyone installs linux anywhere in your organization).

-- 
  Toshio Kumagai	(Toshio_Kumagai@Kumasan.ORG), Japan