Ports 1~1024 are reserved ports, so they are hardly source ports. But there are some exceptions, such as connections from NAT machines. See 1.9.
You often see ports immediately after 1024, which are "dynamic ports" assigned by the system to applications that do not care which port to connect to.
Server Client Service Description
1-5/tcp Dynamic FTP Port 1-5 means sscan script
20/tcp Dynamic FTP Port where the FTP server transmits files 53 Dynamic FTP DNS sends UDP responses from this port. You may also see TCP connections for the source/destination port.
123 Dynamic S/NTP Simple Network Time Protocol (S/NTP) server running port. They will also be sent to the broadcast on this port.
27910~27961/udp Dynamic Quake Quake or Quake engine-driven games run their servers on this port. Therefore, UDP packets from this port range or UDP packets sent to this port range are usually games.
Dynamics above 61000 FTP ports above 61000 may come from Linux NAT server (IP Masquerade)
To find out whether your machine has been planted with a *, run "NETSTAT-an". Check whether the following ports are connected. Port * 555 phAse zero 1243 Sub-7, SubSeven 3129 Masters Paradise 6670 DeepThroat 6711 Sub-7, SubSeven 6969 GateCrasher 21544 GirlFriend 12345 NetBus 23456 EvilFtp 27374 Sub-7, SubSeven 30100 NetSphere 31789 Hack ‘a’Tack 31337 BackOrific, and many others 50505 Sockets de Troie
You often see ports immediately after 1024, which are "dynamic ports" assigned by the system to applications that do not care which port to connect to.
Server Client Service Description
1-5/tcp Dynamic FTP Port 1-5 means sscan script
20/tcp Dynamic FTP Port where the FTP server transmits files 53 Dynamic FTP DNS sends UDP responses from this port. You may also see TCP connections for the source/destination port.
123 Dynamic S/NTP Simple Network Time Protocol (S/NTP) server running port. They will also be sent to the broadcast on this port.
27910~27961/udp Dynamic Quake Quake or Quake engine-driven games run their servers on this port. Therefore, UDP packets from this port range or UDP packets sent to this port range are usually games.
Dynamics above 61000 FTP ports above 61000 may come from Linux NAT server (IP Masquerade)
To find out whether your machine has been planted with a *, run "NETSTAT-an". Check whether the following ports are connected. Port * 555 phAse zero 1243 Sub-7, SubSeven 3129 Masters Paradise 6670 DeepThroat 6711 Sub-7, SubSeven 6969 GateCrasher 21544 GirlFriend 12345 NetBus 23456 EvilFtp 27374 Sub-7, SubSeven 30100 NetSphere 31789 Hack ‘a’Tack 31337 BackOrific, and many others 50505 Sockets de Troie