My network group said they’re seeing port scan traffic from my Domino server’s LDAP port 389 to random high ports on my anti-spam server, which uses Domino as its LDAP source. Here are a couple of log entries from the Netscreen:
Aug 12 04:45:16 10.57.30.12 NS-204: NetScreen device_id=NS-204 [Root]system-alert-00016: Port scan! From 10.57.100.11:389 to 10.57.160.11:1434, proto TCP (zone Trust, int ethernet1). Occurred 1 times.
Nov 8 10:11:25 10.57.30.12 NS-204: NetScreen device_id=NS-204 [Root]system-alert-00016: Port scan! From 10.57.100.10:389 to 10.57.160.11:4050, proto TCP (zone Trust, int ethernet1). Occurred 1 times.
Curious if it’s normal for Domino LDAP to use ports other than 389, or if this is indicative of a problem.