Weird Incoming IP's and port numbers.

From: West P. (god-adminat_private)
Date: Sun Aug 26 2001 - 19:21:01 PDT

  • Next message: Emil Popov: "Re: annoying ftp probes"

    I'm using @home internet cable.  I have the linksys cable router + 4 port
    switch.  This splits the connection to 3 computers in the house.  DHCP is
    turned off.  The Internal IPs are 192.168.1.x  (2,3,4)... Over the past day
    I received a couple of weird INCOMING entries in the log.
    
    DATE           TIME        SCR       SCR_PORT      DEST         DEST_PORT
    08/25/2001 13:24:52  192.168.1.8      80          <my ip address>      3976
    08/25/2001 19:04:42  192.168.1.16    80         <my ip address>       4319
    08/25/2001 23:25:38  192.168.1.9      80          <my ip address>      4450
    
    How is it possible that these are coming into the router from the outside?
    Is this an error on the router?  Do any of these ports seem familiar.
    
    Extra note:  When I tried to make a connection with these ports from within
    my network it refused the connection and didn't put it in the incoming or
    outgoing log.
    
    Is there an explanation for this?
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Mon Aug 27 2001 - 13:02:54 PDT