Date: Wed, 26 Sep 2001 14:12:52 -0700 (PDT) From: Mikko Tyolajarvi <mikko@dynas.se> To: mackinnon.m@home.com Cc: questions@freebsd.org Subject: Re: @home DNS server seems to be scanning my ports? Message-ID: <200109262112.f8QLCqu75754@explorer.rsa.com> References: <20010926184539.55B2737B40B@hub.freebsd.org> <5.0.2.1.0.20010926121341.00a5de40@netmail.home.com>
next in thread | previous in thread | raw e-mail | index | archive | help
In local.freebsd.questions you write: >I keep getting these messages on my freebsd system: >"Connection attempt to UDP <my IP>:X from 24.69.255.196:53 >where X is some port number. It's usually different. The latest ones were, >in series, ports 1034, 1036, 1037. Looks like DNS replies to me - is 24.69.255.196 the DNS server of your ISP by any chance? If whatever sent the query has given up and closed its socket, you'd see errors like these (if you are using a NAT gateway I guess there is some funky timeout in the NAT association tables as well - a late reply would cause an error like this too). The reason for the ports appearing in sequence like this is that the clients sending the queries get assigned dynamic port numbers by the system, starting at 1024. Nothing to worry about. >It seems to try to connect to 3-6 ports a day. UDP packets are not "connections" but nevermind... >Does anyone know what these might be from? Is there a problem here? >Is the problem mine or my ISPs? Any way to fix it? They seem to be from a DNS server. There is most likely no problem. >Tech Support said that it was the DHCP server trying to renew, but would >that be on port 53? No, that would be port 67 or 68. $.02, /Mikko -- Mikko Työläjärvi_______________________________________mikko@rsasecurity.com RSA Security To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200109262112.f8QLCqu75754>