Routing problems perhaps?

P

privet

Well-Known Member
Joined
Jan 22, 2004
Messages
202
Reaction score
0
Location
South Africa.
Has anyone else seen this on the firewall that you are running? My current IP address is 66.18.86.12. From the log below, I am getting packets for many other IP's as well.

I am unable to ping any of them.
Looks like it started around 10:50 this morning.

Jun 18 13:14:21 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:4746 66.18.86.83:9898 L=52 S=0x28 I=59528 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:21 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:4760 66.18.86.173:5554 L=52 S=0x28 I=59554 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:21 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:4765 66.18.86.177:5554 L=52 S=0x28 I=59558 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:21 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:4900 66.18.86.124:9898 L=52 S=0x28 I=59611 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:21 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:4876 66.18.86.116:9898 L=52 S=0x28 I=59603 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:21 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:4933 66.18.86.196:5554 L=52 S=0x28 I=59629 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:21 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1174 66.18.86.132:9898 L=52 S=0x28 I=59811 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:21 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1240 66.18.86.140:9898 L=52 S=0x28 I=59886 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:21 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1271 66.18.86.168:9898 L=52 S=0x28 I=59914 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:21 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1267 66.18.86.164:9898 L=52 S=0x28 I=59910 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:21 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1295 66.18.86.179:9898 L=52 S=0x28 I=59932 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:22 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1289 66.18.86.173:9898 L=52 S=0x28 I=59926 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:22 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1291 66.18.86.175:9898 L=52 S=0x28 I=59928 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:22 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1293 66.18.86.177:9898 L=52 S=0x28 I=59930 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:22 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1312 66.18.86.184:9898 L=52 S=0x28 I=59969 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:22 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1325 66.18.86.196:9898 L=52 S=0x28 I=59981 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:22 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1356 66.18.86.225:9898 L=52 S=0x28 I=60010 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:22 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1346 66.18.86.215:9898 L=52 S=0x28 I=60000 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:22 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1354 66.18.86.223:9898 L=52 S=0x28 I=60008 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:22 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1352 66.18.86.221:9898 L=52 S=0x28 I=60006 F=0x4000 T=41 SYN (#30)
Jun 18 13:14:22 boson kernel: Packet log: input DENY ppp0 PROTO=6 221.216.28.51:1395 66.18.86.251:9898 L=52 S=0x28 I=60045 F=0x4000 T=41 SYN (#30)
 
Privet

Might be a virus, W32.Dabber.A and Backdoor.CrashCool opens those port "9898" to listen, there might be a few more, check the anti virus sites and look for references.

Just a guess from my side, might also be a syn flood attempt.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X