A 'NetInfo' daemon is running on this port.  NetInfo is in charge of maintaining databases (or 'maps') regarding the system.  Such databases include the list of users, the password file, and more.  If the remote host is not a NetInfo server, this service should not be reachable directly from the network.

The remote service is a SOCKS (SOCKetS) server, which allows client applications to operate transparently through a firewall.

RIP is an Interior Gateway Protocol and is based on the distance vector routing algorithm.

Routing tables may disclose your internal network architecture and help a remote attacker.

The remote host is running a TFTP (Trivial File Transfer Protocol) daemon. TFTP is often used by routers and diskless hosts to retrieve their configuration. It can also be used by worms to propagate.

The remote host is running a RADIUS server.

The remote web server accepts connections encrypted using Secure HyperText Transfer Protocol (S-HTTP), a cryptographic layer that was defined in 1999 by RFC 2660 and never widely implemented.

The remote host is running Remote PC Access Server. It is, therefore, affected by an information disclosure vulnerability due to the protocol transmitting username and passwords in cleartext. A man-in-the-middle attacker can exploit this to disclose the credentials and then take control of the remote system.

The remote host is a WSP100 802.11b Remote Sensor from Network Chemistry.

This device sniffs data flowing on the channels used by 802.11b and forwards it to any host which 'subscribes' to this device.

An attacker may use this device to sniff 802.11b networks of the area it is deployed from any location.

The remote service is a daemon to monitor and manage an APC UPS battery backup unit.

An IMAP (Internet Message Access Protocol) server is installed and running on the remote host.

The remote service supports the Notes Remote Procedure Call protocol, which is used by Lotus Notes and Lotus Domino to communicate with other servers.

The remote rsync server can be accessed remotely.

The remote host is running a 'discard' service.  This service typically sets up a listening socket and will ignore all the data which it receives. 

This service is unused these days, so it is advised that you disable it.

This service gives potential attackers information about who is connected and who isn't, easing social engineering attacks for example.

This plugin determines the version of the IRC daemon.

Nessus was unable to identify a service on the remote host even though it returned a banner of some type.

It was possible to identify the remote service by its banner or by looking at the error message it sends when it receives a 'HELP' request.

A QMTP/QMQP server is running on this port.
QMTP is a proposed replacement of SMTP by D.J. Bernstein.

** Note that Nessus only runs SMTP tests currently.

It seems that 'Red Hat Interchange' ecommerce and dynamic content management application is running in 'Inet' mode on this port.

Versions 4.8.5 and earlier are flawed and may disclose contents of sensitive files to attackers.

** Nessus neither checked Interchange version nor tried 
** to exploit the vulnerability

The remote host is running xteld, a Minitel emulator. This service allows users to connect to the Teletel network. Some of the servers are expensive. Note that by default, xteld forbids access to the most expensive services.

The remote host is running xteld, a Minitel emulator, in HyperTerminal mode. This service allows users to connect to the Teletel network. Some of the servers are expensive. Note that by default, xteld forbids access to the most expensive services.

By sending a DUMP request to the portmapper, it was possible to enumerate the ONC RPC services running on the remote port.  Using this information, it is possible to connect and bind to each service by sending an RPC request to the remote port.

The remote host is an Alcatel PABX 4400.

This device can be configured thru the serial port or using this port. 

Outsiders should not be able to connect to this device.

Citrix servers allow a Windows user to remotely obtain a graphical login (and therefore act as a local user on the remote host).

NOTE: by default the Citrix Server application utilizes a weak 40 bit obfuscation algorithm (not even a true encryption).  If the default settings have not been changed, there are tools that can be used to passively discover userIDs and passwords as they traverse a network.

If this server is located within your DMZ, the risk is substantially higher, as Citrix necessarily requires access into the internal network for applications like SMB browsing, file sharing, email synchronization, etc.

If an attacker gains a valid login and password, this service could be used to gain further access on the remote host or remote network. This protocol has also been shown to be vulnerable to a man-in-the-middle attack.

The Remote Desktop Protocol allows a user to remotely obtain a graphical login (and therefore act as a local user on the remote host).

If an attacker gains a valid login and password, this service could be used to gain further access on the remote host.  An attacker may also use this service to mount a dictionary attack against the remote host to try to log in remotely.

Note that RDP (the Remote Desktop Protocol) is vulnerable to Man-in-the-middle attacks, making it easy for attackers to steal the credentials of legitimate users by impersonating the Windows server.

The X Display Manager Control Protocol (XDMCP) service allows a Unix user to remotely obtain a graphical X11 login and therefore act as a local user on the remote host. If an attacker can gain a valid login and password, this service could be used to gain further access on the remote host. An attacker may also use this service to mount a dictionary attack against the remote host to try to log in remotely.

Note that XDMCP is vulnerable to man-in-the-middle attacks, making it easy for attackers to steal the credentials of legitimate users by impersonating the XDMCP server. In addition to this, XDMCP is not a ciphered protocol, which allows an attacker to capture the keystrokes entered by the user.

This machine answered to a unicast UPnP NOTIFY packet by trying to fetch the XML description that Nessus advertised.

Symantec pcAnywhere allows a Windows user to remotely obtain a graphical login (and therefore act as a local user on the remote host).

The remote server is an RTSP server.  RTSP is a client-server multimedia presentation protocol, which is used to stream videos and audio files over an IP network. 

It is usually possible to obtain the list of capabilities and the server name of the remote RTSP server by sending an OPTIONS request.

The remote host is running VNC (Virtual Network Computing), which uses the RFB (Remote Framebuffer) protocol to provide remote access to graphical user interfaces and thus permits a console on the remote host to be displayed on another.

The remote host is running healthd, a daemon which uses the sensors of the remote host to report the temperature of various of its components. 

It is recommended to not let anyone connect to this port.

The remote service understands the Apple Filing Protocol (AFP) and responds to a 'FPGetSrvrInfo' ('DSIGetStatus') request with information about itself. 

AFP is used to offer file services for Mac OS X as well as the older Mac OS. In the past, it has also been known as 'AppleTalk Filing Protocol' and 'AppleShare'.

This script contacts the remote DHCP server (if any) and attempts to retrieve information about the network layout. 

Some DHCP servers provide sensitive information such as the NIS domain name, or network layout information such as the list of the network web servers, and so on. 

It does not demonstrate any vulnerability, but a local attacker may use DHCP to become intimately familiar with the associated network.

The remote host is running a PPTP (Point-to-Point Tunneling Protocol) server.  It allows users to set up a tunnel between their host and the network the remote host is attached to.

The remote host is running an AMANDA backup system client.  AMANDA is a backup system that allows a single backup server to backup multiple hosts.

This detects the AFS client version by connecting to the AFS callback port and processing the buffer received. The client version gives potential attackers additional information about the system they are attacking. Versions and types should be ommited where possible.

The remote host is running an X11 server.  X11 is a client-server protocol that can be used to display graphical applications running on a given host on a remote client. 

Since the X11 traffic is not ciphered, it is possible for an attacker to eavesdrop on the connection.

LCDproc is a client/server suite which contains drivers for LCD devices.

The remote service can be used to display messages on the LCD display attached to the remote host.

The remote service responded to a talk request. 

A talk server (also known as 'talkd', 'in.talk', or 'ntalk') is a service that works over UDP and notifies a user when someone wants to initiate a conversation. 

Note that talk is nowadays considered by many to be obsolete.

The remote host is running LinuxConf, a web-based administration tool for Linux. It is suggested to not allow anyone to connect to this service.

The 'dtspcd' service is running.  This service deals with the CDE interface for the X11 system.

The remote host is running Symantec pcAnywhere Status server, a service used to discover pcAnywhere servers on a network.

A server listens for TCP connections on TCP port 17. Once a connection is established a short message is sent out the connection (and any data received is thrown away). The service closes the connection after sending the quote.

Another quote of the day service is defined as a datagram based application on UDP.  A server listens for UDP datagrams on UDP port 17.
When a datagram is received, an answering datagram is sent containing a quote (the data in the received datagram is ignored).

An easy attack is 'pingpong' which IP spoofs a packet between two machines running qotd. This will cause them to spew characters at each other, slowing the machines down and saturating the network.

The remote host is running a Telnet server, a remote terminal server.

It is possible to obtain information about the remote SSH server by sending an empty authentication request.

The remote host is running a mail (SMTP) server on this port. 

Since SMTP servers are the targets of spammers, it is recommended you disable it if you do not use it.

The remote host is running a server that understands the Post Office Protocol (POP), used by email clients to retrieve messages from a server, possibly across a network link.

The remote host is running a news server (NNTP).  Make sure that hosting such a server is authorized by your company policy.

A Nessus daemon is listening on the remote port.

ID	Name	Severity
11897	NetInfo Daemon Detection	info
11865	SOCKS Server Detection	info
11822	RIP Detection	info
11819	TFTP Daemon Detection	info
11738	RADIUS Server Detection	info
11720	Secure HyperText Transfer Protocol (S-HTTP) Detection	medium
11673	Remote PC Access Server detection.	medium
11559	Network Chemistry Wireless Sensor Detection	medium
11483	apcnisd / apcupsd Detection	info
11414	IMAP Service Banner Retrieval	info
11410	IBM Lotus Notes Detection	info
11389	rsync Service Detection	info
11367	Discard Service Detection	info
11222	writesrv Service Detection	info
11156	IRC Daemon Version Detection	info
11154	Unknown Service Detection: Banner Retrieval	info
11153	Service Detection (HELP Request)	info
11134	QMTP/QMQP Server Detection	info
11128	Red Hat Interchange INET Mode Detection	medium
11121	xtel Detection	info
11120	xtelw Detection	info
11111	RPC Services Enumeration	info
11019	Alcatel PABX 4400 Detection	info
10942	Citrix Server Detection	info
10940	Remote Desktop Protocol Service Detection	info
10891	X Display Manager Control Protocol (XDMCP) Detection	medium
10829	UPnP Client Detection	info
10794	Symantec pcAnywhere Detection (TCP)	info
10762	RTSP Server Type / Version Detection	info
10758	VNC HTTP Server Detection	info
10731	healthd Detection	info
10666	Apple Filing Protocol Server Detection	info
10663	DHCP Server Detection	low
10622	PPTP Detection	info
10462	AMANDA Client Version	info
10441	AFS Client Version Detection	info
10407	X Server Detection	low
10379	LCDproc Detection	info
10342	VNC Software Detection	info
25201	Talk Service (talkd, in.talk, ntalk) Detection	info
10135	LinuxConf Detection	info
10833	CDE Subprocess Control Service (dtspcd) Detection	info
10006	Symantec pcAnywhere Status Service Detection (UDP)	info
10198	Quote of the Day (QOTD) Service Detection	medium
10281	Telnet Server Detection	info
10267	SSH Server Type and Version Information	info
10263	SMTP Server Detection	info
10185	POP Server Detection	info
10159	NNTP Server Detection	info
10147	Nessus Server Detection	info

Detections

Analytics

Service detection Family for Nessus

info

info

info

info

info

medium

medium

medium

info

info

info

info

info

info

info

info

info

info

medium

info

info

info

info

info

info

medium

info

info

info

info

info

info

low

info

info

info

low

info

info

info

info

info

info

medium

info

info

info

info

info

info