Should I be worried (lots of weird port activity)

SoulSe · Jan 14, 2005

Oh my *** - I just cleared the logs on my router today and noticed that there is weird port activity going on. Either I am constantly bring attacked, or Sentech is doing something weird.

Here is a snippet from my logs:

Code:

[2000-01-01 00:00:00] | From:[192.168.69.10] | ICMP | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[3128] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[3777] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[3802] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[6588] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[8080] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[65506] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[14441] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[808] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[23] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[1080] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[1978] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[3127] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[4777] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[7600] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[22233] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[10001] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[9876] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[30022] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[36292] | [Blocked]
[2005-01-12 10:44:40] | From:[82.96.96.3] | Port:[38888] | [Blocked]
[2005-01-12 11:18:47] | From:[66.18.165.145] | Port:[6129] | [Blocked]
[2005-01-12 11:58:39] | From:[217.17.252.68] | Port:[6881] | [Blocked]
[2005-01-12 12:13:46] | From:[80.219.58.122] | Port:[5554] | [Blocked]
[2005-01-12 12:19:23] | From:[66.79.85.85] | Port:[1025] | [Blocked]
[2005-01-12 12:47:02] | From:[81.173.232.77] | Port:[4672] | [Blocked]
[2005-01-12 13:08:24] | From:[213.39.187.48] | Port:[4662] | [Blocked]
[2005-01-12 13:32:12] | From:[209.152.179.10] | Port:[21337] | [Blocked]
[2005-01-12 13:53:55] | From:[12.6.42.241] | Port:[1026] | [Blocked]
[2005-01-12 13:53:56] | From:[12.64.210.2] | Port:[1027] | [Blocked]
[2005-01-12 14:21:49] | From:[211.28.227.183] | Port:[6881] | [Blocked]
[2005-01-12 14:53:02] | From:[200.162.194.162] | Port:[1434] | [Blocked]
[2005-01-12 15:20:36] | From:[194.208.123.81] | Port:[21] | [Blocked]
[2005-01-12 15:51:50] | From:[61.91.174.154] | Port:[6101] | [Blocked]
[2005-01-12 16:19:52] | From:[61.129.49.189] | Port:[12870] | [Blocked]
[2005-01-12 16:47:14] | From:[218.15.21.111] | Port:[12870] | [Blocked]
[2005-01-12 16:48:17] | From:[66.43.187.115] | Port:[3389] | [Blocked]
[2005-01-12 17:09:00] | From:[218.254.142.170] | Port:[5554] | [Blocked]
[2005-01-12 17:09:00] | From:[218.254.142.170] | Port:[9898] | [Blocked]
[2005-01-12 17:32:43] | From:[11.214.216.110] | Port:[1027] | [Blocked]
[2005-01-12 17:58:20] | From:[82.82.52.114] | Port:[6101] | [Blocked]
[2005-01-12 18:18:00] | From:[80.28.116.233] | Port:[6881] | [Blocked]
[2005-01-12 19:12:41] | From:[81.7.81.153] | Port:[6101] | [Blocked]
[2005-01-12 19:21:22] | From:[81.172.10.10] | Port:[6101] | [Blocked]
[2005-01-12 20:34:40] | From:[66.198.105.142] | Port:[1025] | [Blocked]
[2005-01-12 21:11:58] | From:[11.220.182.40] | Port:[1026] | [Blocked]
[2005-01-12 22:32:54] | From:[213.130.103.107] | Port:[4662] | [Blocked]
[2005-01-12 22:37:12] | From:[203.253.34.195] | Port:[1433] | [Blocked]
[2005-01-12 23:01:39] | From:[165.165.42.24] | Port:[18488] | [Blocked]
[2005-01-12 23:13:52] | From:[81.190.68.156] | Port:[6101] | [Blocked]
[2005-01-12 23:37:21] | From:[66.117.136.168] | Port:[5000] | [Blocked]
[2005-01-12 23:37:33] | From:[220.77.226.199] | Port:[5554] | [Blocked]
[2005-01-12 23:37:34] | From:[220.77.226.199] | Port:[1023] | [Blocked]
[2005-01-12 23:37:36] | From:[220.77.226.199] | Port:[9898] | [Blocked]
[2005-01-12 23:38:03] | From:[220.78.218.49] | Port:[9898] | [Blocked]
[2005-01-13 00:12:53] | From:[194.78.204.128] | Port:[4899] | [Blocked]
[2005-01-13 00:19:45] | From:[69.70.184.85] | Port:[5554] | [Blocked]
[2005-01-13 00:19:45] | From:[69.70.184.85] | Port:[9898] | [Blocked]
[2005-01-13 00:23:57] | From:[66.18.137.56] | Port:[3410] | [Blocked]
[2005-01-13 00:23:57] | From:[66.18.137.56] | Port:[5554] | [Blocked]
[2005-01-13 00:23:57] | From:[66.18.137.56] | Port:[5000] | [Blocked]
[2005-01-13 00:23:57] | From:[66.18.137.56] | Port:[1433] | [Blocked]
[2005-01-13 00:33:46] | From:[66.18.164.183] | Port:[6129] | [Blocked]
[2005-01-13 00:48:26] | From:[11.243.232.51] | Port:[1026] | [Blocked]
[2005-01-13 00:48:27] | From:[12.211.18.167] | Port:[1027] | [Blocked]
[2005-01-13 01:01:34] | From:[84.160.239.243] | Port:[4662] | [Blocked]
[2005-01-13 01:15:01] | From:[129.241.137.159] | Port:[18488] | [Blocked]
[2005-01-13 01:57:17] | From:[66.30.194.220] | Port:[6881] | [Blocked]
[2005-01-13 02:10:40] | From:[61.152.94.179] | Port:[22790] | [Blocked]
[2005-01-13 02:32:28] | From:[65.18.86.249] | Port:[1026] | [Blocked]
[2005-01-13 02:37:57] | From:[154.5.79.221] | Port:[42] | [Blocked]
[2005-01-13 03:15:43] | From:[205.244.97.232] | Port:[6101] | [Blocked]
[2005-01-13 03:36:48] | From:[219.253.214.53] | Port:[4899] | [Blocked]
[2005-01-13 03:43:13] | From:[220.126.25.20] | Port:[4899] | [Blocked]
[2005-01-13 04:13:18] | From:[172.202.5.143] | Port:[1434] | [Blocked]
[2005-01-13 04:16:05] | From:[61.154.127.207] | Port:[2528] | [Blocked]
[2005-01-13 04:17:06] | From:[207.44.194.25] | Port:[988] | [Blocked]
[2005-01-13 04:23:55] | From:[61.80.239.144] | Port:[4899] | [Blocked]
[2005-01-13 04:27:49] | From:[12.20.42.219] | Port:[1026] | [Blocked]
[2005-01-13 04:27:52] | From:[66.211.204.124] | Port:[5000] | [Blocked]
[2005-01-13 04:34:01] | From:[66.129.144.190] | Port:[5554] | [Blocked]
[2005-01-13 05:00:43] | From:[218.156.238.253] | Port:[4899] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[81] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[444] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[2282] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[3332] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[5490] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[7000] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[8000] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[8001] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[8081] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[19086] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[22788] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[63809] | [Blocked]
[2005-01-13 05:13:28] | From:[82.96.96.3] | Port:[4480] | [Blocked]
[2005-01-13 05:13:36] | From:[213.100.46.223] | Port:[1434] | [Blocked]
[2005-01-13 05:36:59] | From:[221.155.181.224] | Port:[5554] | [Blocked]
[2005-01-13 05:37:00] | From:[221.155.181.224] | Port:[1023] | [Blocked]
[2005-01-13 05:37:02] | From:[221.155.181.224] | Port:[9898] | [Blocked]
[2005-01-13 07:22:11] | From:[61.152.94.179] | Port:[41514] | [Blocked]

Should I be worried? My Linux boxes are all tight as a frog's arse and my router firewall is pretty nifty, I just want to know what is going on? Oh, and I'm not running any p2p software if that's what you're thinking

DFantom · Jan 14, 2005

looks normal for an always on connection. the longer you are online the higher the chance someone will try things, like the 82.96.96.3 looks like a port scan. if you have a decent firewall there is nothing to really worry about

SoulSe · Jan 14, 2005

Cool, thanks DFantom.

I guess the dynamic IP assignment with MyWi also helps with security in this regard - but sucks for everything else (it's a mission to ssh into my box - have to use all sorts of tricks to track my ip).

JayT · Jan 14, 2005

the ports look like bittorrent clients trying to connect.

privet · Jan 15, 2005

dyndns.org

SoulSe said:
Cool, thanks DFantom.

I guess the dynamic IP assignment with MyWi also helps with security in this regard - but sucks for everything else (it's a mission to ssh into my box - have to use all sorts of tricks to track my ip).

I use www.dyndsn.org for this. ddclient does the update for me out of my ip-up.local script. Many routers have built-in support for dynamic DNS services.

Join the MyBroadband community

Get started

Should I be worried (lots of weird port activity)

SoulSe

Active Member

DFantom

Expert Member

SoulSe

Active Member

JayT

Senior Member

privet

Well-Known Member