# Port 4662 **URL:** \ **Category:** Chatting over the Back Fence\ **Created:** [July 25, 2012, 5:17pm UTC](https://forums.suse.com/t/port-4662/22886 "2012-07-25T17:17:44Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![System1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@System1](https://forums.suse.com/u/System1)\ **Post date:** [July 25, 2012, 5:17pm UTC](https://forums.suse.com/t/port-4662/22886/1 "2012-07-25T17:17:44Z")
Hi all: I have been seeing a lot of traffic on port 4662 across our WANs via using Cisco’s nbar discovery. Cisco labels it a eDonkey, which is a file sharing system, but I have my doubts that is the culprit. Do you know of any other applications typically found in a mixed OES/Windows (eDir/AD) environment that might be making use of this port? Also, I am not sure how to go about sniffing for this port traffic using Wireshark? Can someone help me out with this? Thanks, Chris. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [July 25, 2012, 6:03pm UTC](https://forums.suse.com/t/port-4662/22886/2 "2012-07-25T18:03:37Z")
We run a mixed environment and near as I can tell have no traffic running around on ports 4662. “tcp.port==4662 || udp.port==4662” is an option for a wireshark display filter, but also wireshark has built in filters for edonkey traffic. If you are a switching environment, make sure to configure your switch to span or mirror to your capture port. Interesting reading: [http://www.speedguide.net/port.php?port=4662](http://www.speedguide.net/port.php?port=4662) [http://isc.sans.edu/port.html?port=4662](http://isc.sans.edu/port.html?port=4662) With only this info, I wouldn’t rule out that you may indeed have some emule/edonky traffic running around. On 7/25/2012 9:17 AM, Chris wrote:[color=blue] > Hi all: I have been seeing a lot of traffic on port 4662 across our > WANs via using Cisco’s nbar discovery. Cisco labels it a eDonkey, which > is a file sharing system, but I have my doubts that is the culprit. Do > you know of any other applications typically found in a mixed > OES/Windows (eDir/AD) environment that might be making use of this port? > Also, I am not sure how to go about sniffing for this port traffic using > Wireshark? Can someone help me out with this? > Thanks, Chris.[/color] ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [July 25, 2012, 6:23pm UTC](https://forums.suse.com/t/port-4662/22886/3 "2012-07-25T18:23:00Z")
On Wed, 25 Jul 2012 15:03:37 +0000, unsigned wrote: [color=blue] > We run a mixed environment and near as I can tell have no traffic > running around on ports 4662. > [/color] > Close the port and see who complains. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [July 25, 2012, 6:50pm UTC](https://forums.suse.com/t/port-4662/22886/4 "2012-07-25T18:50:08Z")
On 25/07/2012 16:23, Bob Crandell wrote:[color=blue] > On Wed, 25 Jul 2012 15:03:37 +0000, unsigned wrote: > [color=green] > > > We run a mixed environment and near as I can tell have no traffic > > running around on ports 4662. > > [/color] > > Close the port and see who complains. > > [/color] That was going to be my response 🙂 Lance ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [August 1, 2012, 11:24am UTC](https://forums.suse.com/t/port-4662/22886/5 "2012-08-01T11:24:07Z")
Lance Haig [lhaig@haigmail.com](mailto:lhaig@haigmail.com) wrote in news:QAUPr.1902$If2.644 @kovat.provo.novell.com: [color=blue] > On 25/07/2012 16:23, Bob Crandell wrote:[color=green] > > > On Wed, 25 Jul 2012 15:03:37 +0000, unsigned wrote: > > [color=darkred] > > > > > We run a mixed environment and near as I can tell have no traffic > > > running around on ports 4662. > > > [/color] > > > Close the port and see who complains. > > > [/color] > > That was going to be my response > > 🙂 > > Lance[/color] Doing that possibly drives something into a harder to detect mode. Probably not a good thing for the situation when you are playing detective. Besides, I thought IT was the enabler; the customer wants the thing now and they want that bandwidth now and just make it happen with no notice 🙂 – Ciao, Dave ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [August 1, 2012, 6:10pm UTC](https://forums.suse.com/t/port-4662/22886/6 "2012-08-01T18:10:01Z")
On Wed, 01 Aug 2012 08:24:07 +0000, Dave Taylor wrote: [color=blue] > Lance Haig [lhaig@haigmail.com](mailto:lhaig@haigmail.com) wrote in news:QAUPr.1902$If2.644 > @kovat.provo.novell.com: > [color=green] > > > On 25/07/2012 16:23, Bob Crandell wrote:[color=darkred] > > > > > On Wed, 25 Jul 2012 15:03:37 +0000, unsigned wrote: > > > > > > > We run a mixed environment and near as I can tell have no traffic > > > > running around on ports 4662. > > > > [/color][/color] > > Besides, I thought IT was the enabler; the customer wants the thing now > and they want that bandwidth now and just make it happen with no notice > :)[/color] Being the enabler is so yesterday. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\ **Post date:** [August 1, 2012, 7:48pm UTC](https://forums.suse.com/t/port-4662/22886/7 "2012-08-01T19:48:29Z")
w00t, being the disabler is ‘in’ On 8/1/2012 10:10 AM, Bob Crandell wrote:[color=blue] > Being the enabler is so yesterday. > [/color]