Re: TCP on remote port 53??

From: Karl Levinson [x y] MVP (levinson_k@excite.com)
Date: 10/21/02 

From: "Karl Levinson [x y] MVP" <levinson_k@excite.com>
Date: Mon, 21 Oct 2002 09:27:46 -0400

"WRCsam" <UUsam@WTFhotmail.com.uu.WTF> wrote in message
news:eaJAgOIeCHA.2588@tkmsftngp12...
> My firewall logs this pretty often
>
> Device 1, Blocked outgoing TCP packet (no matching rule), src='my ip
here',
> dst=153.39.194.10, sport=1278, dport=53
>
> If it wasn't TCP protocol, then it would be DNS connection attempt.
>
> Do you have the same problem, which app is doing the connecting?
>
> How can I find out which app is opening this connection?

As mentioned in the other post, DNS might also require you to open up TCP 53
as well as UDP 53. I understand that DNS requests that do not fit in one
UDP packet are resent as TCP 53.

Firewalls such as Sygate will log which app is doing the requesting on
outbound transmissions and some inbound ones. Zone Alarm might also do
this, not sure. Both have versions that are free for non-commercial users.

Relevant Pages

  • Re: [unisog] Re: large scale distributed scan of port tcp 445
    ... > Which firewall logs these are? ... whether it was a TCP Scan of halfopen SYN Scan? ... reads argus records. ...
    (Incidents)
  • [OT] port 2896
    ... I keep seeing on my firewall logs quite a few droped attempts to connect ... to port 2896 both udp and tcp. ...
    (Debian-User)
  • Re: Truncated firewall log entries.
    ... >> I was just checking my firewall logs and found these two entries in ... > further - it's not TCP or UDP traffic and as such there are no ports to ...
    (comp.os.linux.security)
  • TCPListener works in Win app but not in service app
    ... The service app starts thusly, creating the tcp object and starting the ... The win app is the same, really just a tester for the logic in the service, ... metrics.Log(LogNameServer, SourceNameServer, "Server.Start") ...
    (microsoft.public.dotnet.general)
  • Re: TCP on remote port 53??
    ... As for what app is doing the work, I would guess the DNS Client ... > Device 1, Blocked outgoing TCP packet, src='my ip ... > If it wasn't TCP protocol, then it would be DNS connection attempt. ...
    (microsoft.public.win2000.security)