Not a new botnet after all

Last week I mentioned mysterious network activity which had been seen on ports 1720 and 1863 from both Windows and Linux systems. Analysts were worried that this was a new botnet coming on line, although no actual network traffic had been observed. I noted that port 1720 was associated with video conferencing and perhaps the observed behavior simply represented video conferencing software waiting for incoming connections. (Also, port 1863 is associated with file-sharing software.)

Turns out I wasn't far off. It seems that the network activity came not from the host computers, but from a firewall product which was acknowledging network connections from the outside on the behalf of the hosts on the inside of the firewall. This sort of makes perfect sense since both video conferencing and file sharing are peer-to-peer protocols that require that client software find a way around the firewalls.

Arguably, this is very bad form, but it's not malicious. Nothing to see here; we can all go home now.