Subject: Re: [Fwd: RE: Application for port-number (1026)]

From: Andrew Davison <[email-masked]>
Date: Sun, 04 Aug 2002 15:11:25 +1000

I just installed WIN2K Service Pack 3 (SP3) today and guess what? It has 
started using port 1026 for it's own inscrutable reasons! It opens that 
port early on (among many others) on all interfaces,  and it definitely 
is not a calendar server. I assume it started using port 1025, then 1026 
etc. as ephemeral ports but for listening. The same probably exists in 
WINXP as i believe a lot of stuff was back ported to WIN2K in SP3. I 
have been through all stoppable services and nothing i could find would 
disable it. Nor have i been able to find any information on it at 
microsoft.com so perhaps someone is in a position of knowledge and could 
comment.

---

From: Doug Royer <[email-masked]>
Date: Sun, 04 Aug 2002 12:40:57 -0600

> microsoft.com so perhaps someone is in a position of knowledge and could

Port 1026 is currently registered with IANA for CAP.

As to what MS is doing with that port, some checking shows
me that NT runs mstask.exe on port 1026, what ever that is.

There are several reported hack attempts to bring an NT
box down via some bug using 1026. The reading also shows
me that mstask.exe starts at 1025 and starts looking
for unused ports. I do not know the NT flavor of the MS
OS's, but if that is true, start your CAP server first
then it will find the first unused port after that.

-Doug

---

From: Andrew Davison <[email-masked]>
Date: Mon, 05 Aug 2002 09:41:09 +1000

>then it will find the first unused port after that.
you're right, it's the 'Task Scheduler' service ( i remember i didn't 
stop that one). my guess is it's the new remote update facility: 
micrsoft must connect to the task scheduler to tell it it has work to 
do, push rather than pull (how does it know my server is there? on 
startup it must inform microsoft i suppose). having to alter startup 
dependancies of operating system components will sure make deploying a 
CAP server more difficult on WIN2K and XP.

ad

---

From: andrew davison <[email-masked]>
Date: Mon, 05 Aug 2002 10:04:03 +1000

>then it will find the first unused port after that.

actually, ms use ports >1024 and <5000 as ephemeral ports so any 
assignment of CAP in that area will run into potential difficulties, 
especially so close to the lower end. i'm told Active Directory can also 
grab 1025 & 1026 for logon and replication services.

---

From: Doug Royer <[email-masked]>
Date: Sun, 04 Aug 2002 18:05:38 -0600

> CAP server more difficult on WIN2K and XP.

I would think that the wonderful M$ tools do that for you :-)

Plus, if they are looking for unused ports, I would think
that they would make sure that mstask.exe is one of the
last things started, otherwise they could break many things.