Port 4644?

February 26, 2004 7:59 PM

My router tells me that many IPs are trying to connect to my PC on port 4644. Why?

Here's what my log file looks like:

82.83.67.202 4644
82.84.172.8 4644
82.83.67.202 4644
61.42.129.162 4644
80.36.213.139 4644
61.42.129.162 4644
80.36.213.139 4644
80.36.213.139 4644
80.36.213.139 4644
67.68.177.23 4644
62.211.216.206 4644
81.51.197.166 4644
81.51.197.166 4644
62.211.216.206 4644

posted by johnnydark to computers & internet (6 comments total)

My first thought is that someone's connecting to your site through a proxy of some sort, perhaps from behind a firewall. Do some of your readers access the site from work? If so, that may be it.
posted by bedhead at 11:13 PM on February 26, 2004

Isn't that SoulSeek's port of choice?
posted by yerfatma at 4:38 AM on February 27, 2004

Your search - soulseek "port 4644" - did not match any documents.
posted by angry modem at 7:34 AM on February 27, 2004

Yeah, that's not it (I'm away from home). I just remember seeing this in a port scan I ran a month or two ago and getting all freaked out until I figured out what it was. But now I forget. So that's helpful.
posted by yerfatma at 9:42 AM on February 27, 2004

Could that be some sort of ICMP traffic? I know ICMP is portless, but could the number be some sort of decimal encoding of the ICMP code?
posted by mr_roboto at 11:48 AM on February 27, 2004

It seems port 4644 is a popular port for proxies to run on. Which means...

People are probing you to see if you have an open proxy. Spammers love these to cover their tracks.
posted by shepd at 12:58 PM on February 27, 2004