Norton Antibot calling out on port TCP 37

Archive
1

Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Sed posuere consectetur est at lobortis. Vestibulum id ligula porta felis euismod semper. Donec ullamcorper nulla non metus auctor fringilla. Aenean lacinia bibendum nulla sed consectetur. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Cras mattis consectetur purus sit amet fermentum. Morbi leo risus, porta ac consectetur ac, vestibulum at eros. Sed posuere consectetur est at lobortis. Etiam porta sem malesuada magna mollis euismod. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Aenean eu leo quam. Pellentesque ornare sem lacinia quam venenatis vestibulum. Curabitur blandit tempus porttitor. Sed posuere consectetur est at lobortis.

2

Jordan,

 

This is for internal clock determinations to make sure that your subscription/expiration time remains accurate.

3

From AuditMyPC

TCP port 37.

Time. Provides remote timing stat's of internal processing events. Security Concerns: Gives remote attacker info on host's internal processing load. Can identify critical processing times, plus output can be looped to echo port (7) and create a DOS threat to the subnet. Disable this port on all hosts.

TCP port 37 uses the Transmission Control Protocol. TCP is one of the main protocols in TCP/IP networks. Whereas the IP protocol deals only with packets, TCP enables two hosts to establish a connection and exchange streams of data. TCP guarantees delivery of data and also guarantees that packets will be delivered on port 37 in the same order in which they were sent. Guaranteed communication over port 37 is the key difference between TCP and UDP. UDP port 37 would not have guaranteed communication in the same way as TCP

 

Calling out several times a day. Not by your choice. Sort of like a Bot would do.

4

Hi PaulS,

 

The client checks for the time may happen a few times per day if the communication cannot be established, however, the requests are randomized so they cannot provide any load visibility to the attacker during normal operation. Also, sending out a request a few times a day can hardly be leveraged for a DOS attack...