Poking at what port 1439 is legitimately used for:
Quote:
Service description(s):
Eicon X25|SNA Gateway
|
from
http://www.seifried.org/security/ports/1000/1439.html
Ring a bell?
From
http://www.tcpdump.org/tcpdump_man.html
Quote:
The general format of a tcp protocol line is:
src > dst: flags data-seqno ack window urgent options
|
More:
Quote:
The
first time tcpdump sees a tcp `conversation', it prints
the sequence number from the packet. On subsequent pack_
ets of the conversation, the difference between the cur_
rent packet's sequence number and this initial sequence
number is printed. This means that sequence numbers after
the first can be interpreted as relative byte positions in
the conversation's data stream (with the first data byte
each direction being `1'). `-S' will override this fea_
ture, causing the original sequence numbers to be output.
|
so what is being seen above is one conversation looks like.
I now know enough to understand half of the TCP dump.
Quote:
src > dst: flags data-seqno ack window urgent options
22:18:19.032975 81.134.108.43.20500 > my-ip.1439: P 130706573:130706575(2) ack 154129622 win 16295 (DF)
// first time tcpdump saw the conversation, hence the huge sequence numbers. Only 2 bytes in this packet
22:18:19.041633 81.134.108.43.20500 > my-ip.1439: P 2:147(145) ack 1 win 16295 (DF)
// Another 145 bytes in this packet
22:18:19.041908 my-ip.1439 > 81.134.108.43.20500: . ack 147 win 64089 (DF)
// Your computer says "I've seen 147 bytes" (number is since tcpdump first started monitoring conversation).
// This packet contains no data, btw.
22:18:19.127558 81.134.108.43.20500 > my-ip.1439: P 147:149(2) ack 1 win 16295 (DF)
// Other computer sends another 2 bytes. Still hasn't heard your computer's "ack" yet.
22:18:19.132455 81.134.108.43.20500 > my-ip.1439: P 149:262(113) ack 1 win 16295 (DF)
// Other computer sends another 113 bytes. Still hasn't heard your computer's "ack" yet.
22:18:19.132716 my-ip.1439 > 81.134.108.43.20500: . ack 262 win 63974 (DF)
// Your computer says "I've heard 262 bytes (since tcpdump started listening into this conversation).
|
The dataflow is towards your computer in this small sample. I cannot tell you who opened the connection.