Re: strange connect attempts FROM port 80 to random(?) ports...

From: Duane Arnold (NotMe_at_NotMe.com)
Date: 09/19/04


Date: Sun, 19 Sep 2004 01:28:27 GMT

meulie@gmail.com wrote in news:1095547265.894819.139870
@h37g2000oda.googlegroups.com:

> Hi everyone!
>
> I'm having quite a few connect attempts from foreign hosts lately,
> always originating on port 80, and heading for a random port on my
> system.

> What could be causing hits like these...? :-?

Why do you even care? The FW is rejecting it. So, you have a few attempts
at some ports and they are being *rejected*. It's something I wouldn't even
give a second thought to it.

And if you had a cheap NAT router setting there, you certainly would pay no
attention to it.

Duane :)



Relevant Pages

  • Re: Found, a new rootkit
    ... A port that portsentry was ... supposed to be rejecting but wasn't. ... Why would your web server be write-able? ...
    (Fedora)
  • Re: securing a network with nfs
    ... > I would deny all traffic by default. ... And if you reject this one port out of 131,070, how much has it really ... camouflages which hosts are actually there or not. ... time than rejecting the one port will save them... ...
    (Focus-Linux)
  • Re: Possible network intrusion - Cant trace IP!
    ... | The situation is the Fsecure Firewall on a number of client machines on our ... | network has blocked traffic reported as the following: ... | Remote port 9500 ... | a way I can sniff for traffic originating from port 9500 on our network to ...
    (microsoft.public.security.virus)
  • Re: Port Scanning
    ... Are all these probes ... it is doing a port scan. ... The log file format is hacked together from Tiny Personal Firewall 3.0 xml ... > so I would report that to the originating ISP. ...
    (comp.security.misc)
  • Re: DNS problem
    ... "My" resolver makes some queries from some high port ... In other words - originating query-port got closed ... >> named listening on both of them when it ...
    (freebsd-stable)