Weird Incoming IP's and port numbers.

From: West P. (god-admin@home.com)
Date: 08/27/01 

Message-ID: <001401c12e9e$eb97f740$0301a8c0@home>
From: "West P." <god-admin@home.com>
To: <incidents@securityfocus.com>
Subject: Weird Incoming IP's and port numbers.
Date: Sun, 26 Aug 2001 22:21:01 -0400

I'm using @home internet cable. I have the linksys cable router + 4 port
switch. This splits the connection to 3 computers in the house. DHCP is
turned off. The Internal IPs are 192.168.1.x (2,3,4)... Over the past day
I received a couple of weird INCOMING entries in the log.

DATE TIME SCR SCR_PORT DEST DEST_PORT
08/25/2001 13:24:52 192.168.1.8 80 <my ip address> 3976
08/25/2001 19:04:42 192.168.1.16 80 <my ip address> 4319
08/25/2001 23:25:38 192.168.1.9 80 <my ip address> 4450

How is it possible that these are coming into the router from the outside?
Is this an error on the router? Do any of these ports seem familiar.

Extra note: When I tried to make a connection with these ports from within
my network it refused the connection and didn't put it in the incoming or
outgoing log.

Is there an explanation for this?

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • Re: Using Remote Desktop From an SBS Domain
    ... when you tried to RDP while attached directly to a port on your router? ... So if 3389 needs forwarded on the client end too then that is what the ... Hopefully next week I can attempt a connection while my ISP watches the ...
    (microsoft.public.windows.server.sbs)
  • Re: Using Remote Desktop From an SBS Domain
    ... when you tried to RDP while attached directly to a port on your router? ... Internet to initiate an IP conversation with your computer. ... This situation is different than if you ran your own NAT connection sharing ...
    (microsoft.public.windows.server.sbs)
  • Re: Setting up Home Network w/ 2 Routers
    ... successfully got my 2Wire, Netgear, and Linksys playing nicely. ... Connected the LAN port #1 of 2Wire to the WAN port of the Netgear. ... connection type and all for me. ... If you add another router to the mix, just make sure to disable the ...
    (microsoft.public.windowsxp.network_web)
  • How did they get behind my NAT?
    ... this point I panicked and shutdown the VNC service ASAP. ... My question is how the attacker got to my VNC port! ... the internet through the router. ... client connection using local port number 5900 (which was also being ...
    (alt.computer.security)
  • Re: Can not access Web and FTP sites from Internet
    ... your IP Configuration on the Server is correctly. ... Connecting To 12.208.215.87...Could not open connection to the host, ... 1> From the result, we can see the telnet failed, which means the router ... does not forward Port 443 to SBS Server. ...
    (microsoft.public.windows.server.sbs)