TCP/UDP Port 491????
 

Anyone hear of this port 491 before. It has a description of go-login. I have never heard of go-login. Any info would be appreciated.

Everywhere I look I get the samething, I haven't a clue. What tipped you off to this anyway?:confused:

Good one!

Cant find $hit on port 491. I will keep looking now that you peaked my interest.

L8r

Chimmy:D

I ran a netstat -an in DOS. It came up with it listening on port 491. I discoverd what it is from though. It is associated with ZoneAlarm VSMON.exe. It is sending information from each of my PC's to my router on that port. I just dont know what it is sending or why. I haven't seen this before when I have done netstat -an in DOS. Very strange. If anything new developes I will let you know.

If anyone esle has ZoneAlarm Pro and a Linksys router. Please let me know if it shows up when you do a netstat -an in DOS. Thanks.

I'd sure like to know myself. This is the first I've heard of it!

If anyone is seeing the same thing, please post so we don't all go nuts trying to figure it out.

it seems that vsmon.exe that resides on udp port 491 is part of the uninstall feature of zonealarm. I'm gonna look more into this but read about an exploit (not remote) I found on vsmon.exe:


http://archives.neohapsis.com/archiv...0-q4/0146.html

I'll keep researching ...

This is interesting..... I can't find anything on PORT 491
Go here

I am pretty positive that port 491 is for zonealarm .... if you have it, then that port will be in state listening from vsmon.exe which, as stated earlier, is used to help shutdown other zonealarm services during the uninstall process.

I have UDP 491 listed with foreign address as *.*

ZAPro and Linky 4port. Not too worried. Have you, by chance checked for an upgrade lately? Fishing to be honest...

Skye

I have it listed as both TCP and UDP. Hear is a excerpt of a netstat -an

TCP 192.168.1.2:491 0.0.0.0:0 LISTENING
UDP 0.0.0.0:5632 *:*
UDP 0.0.0.0:162 *:*
UDP 127.0.0.1:1231 *:*
UDP 192.168.1.2:137 *:*
UDP 192.168.1.2:138 *:*
UDP 192.168.1.2:491 *:*


I haven't done a update check and I also dont have Check for Update automatically checked off in the config panel. That was my first thought for it Listening.

I dont see why it would need to have a UDP Server and a TCP listening to do a uninstall. That doesn't make much sense to me. I am sure it is nothing to be worried about, but I am just curious as to what it is there for. I ran my packet sniffer and couldn't determine what it was sending.