telnet session capturing !?

[mohammed hashim]

hi, 

If you change the tenlnet port to be something other than 23, like 2010, if this packet was captured, can it be identified as telnet packet?

[Mark Malone · Accepted solution]

Hey It will still read as telnet in wireshark not sure regarding other tools , the protocol itself will show up as telnet and it will have another port.The telnet server still initiates the session as the protocol but will use a different number if set like that

[mohammed hashim]

thanks,

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages wha2tsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Depends on whether whatever is looking at the packet does deeper packet inspection than examination of TCP port numbers.  Cisco's NBAR might also identify telnet regardless of port number.