Date: Tue, 1 Jan 2002 13:35:41 -0800 (PST) From: Brian Whalen <bri@sonicboom.org> To: Joe & Fhe Barbish <barbish@a1poweruser.com> Cc: FBSD Questions <questions@FreeBSD.ORG> Subject: Re: IPFW UDP port# 520 Message-ID: <20020101133355.F3347-100000@5131-073-209.015.popsite.net> In-Reply-To: <LPBBIGIAAKKEOEJOLEGOGEPBCKAA.barbish@a1poweruser.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Well I'd be a little suspicious due to the lack of a reverse dns entry for that ip. According to arin, that ip belongs to Alexia Internet. This your isp? Is that ip your gsteway for traffic back out? Brian "Sonic" Whalen Success = Preparation + Opportunity On Tue, 1 Jan 2002, Joe & Fhe Barbish wrote: > Happy new year to all FBSD list readers. > > I see in my security log a lot of denied packets over and > over again of the same kind. > > Deny UDP 208.203.25.3:520 63.163.61.14:520 in via tun0 > > 208.203.25.3 is my ISP's IP address and 63.163.61.14 is my IP address. > > When I lookup what port 520 is it says a local routing process > or Trojan Ripper. I think it's my ISP's front door router > inquiring if I am still there. > Since my firewall is denying the request it just keeps repeating. > > How can I be sure It's my ISP's router and not the Ripper Trojan? > > What rules do I need the add to my IPFW rules set to resolve this? > > Thanks > > Joe > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020101133355.F3347-100000>