Connections from 158.152.1.48/158.152.1.53

Thread View: demon.ip.support.nt

4 messages

[T] Back to Threads [V] Tree View [G] Group Articles

4 total messages Started by Richard Tibbetts Tue, 16 Jul 2002 20:30

#79

Author: Richard Tibbetts
Date: Tue, 16 Jul 2002 20:30

7 lines
1365 bytes

Should I be worried?  My firewall has suddenly started logging *lots*
of attempted connections from the Demon DNS servers from port 53,
trying to connect to a variety of 4nnn ports.  This seems to be a new
thing.
-- 
Richard Tibbetts
http://www.primepeace.ltd.uk/

Re: Connections from 158.152.1.48/158.152.1.53

#80

Author: Richard Clayton
Date: Tue, 16 Jul 2002 22:03

23 lines
1818 bytes

In article <l409jucpmg7vfflb88i9930172dvhaoklg@4ax.com>, Richard
Tibbetts <richard@primepeace.ltd.uk> writes

>Should I be worried?  

yes, your firewall is either useless or you've configured it wrongly

>My firewall has suddenly started logging *lots*
>of attempted connections from the Demon DNS servers from port 53,
>trying to connect to a variety of 4nnn ports.  

I expect it is returning the details of names you have looked up

>This seems to be a new
>thing.

then it will be something you changed recently

-- 
richard                                              Richard Clayton

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety.         Benjamin Franklin

Re: Connections from 158.152.1.48/158.152.1.53

#81

Author: Richard Tibbetts
Date: Wed, 17 Jul 2002 07:47

31 lines
2270 bytes

In message <0vGOdmCAhJN9EAgE@highwayman.com>, Richard Clayton
<richard@highwayman.com> wrote on Tue, 16 Jul 2002 23:03:44 +0100:

> In article <l409jucpmg7vfflb88i9930172dvhaoklg@4ax.com>, Richard
> Tibbetts <richard@primepeace.ltd.uk> writes
> 
> >Should I be worried?  
> 
> yes, your firewall is either useless or you've configured it wrongly

Though the latter is more than possible, the former seems to be the
case this time.  It appears there was a memory leak on the machine,
which had been running for 17 days, and the proxy software/firewall
had run out of memory.

> >My firewall has suddenly started logging *lots*
> >of attempted connections from the Demon DNS servers from port 53,
> >trying to connect to a variety of 4nnn ports.  

Why on port 4nnn??

> I expect it is returning the details of names you have looked up
> 
> >This seems to be a new
> >thing.
> 
> then it will be something you changed recently

-- 
Richard Tibbetts
http://www.primepeace.ltd.uk/

Re: Connections from 158.152.1.48/158.152.1.53

#82

Author: Richard Clayton
Date: Wed, 17 Jul 2002 09:15

25 lines
2263 bytes

In article <h08ajus7tpb6fod14njq854i9ojgkfsk5a@4ax.com>, Richard
Tibbetts <richard@primepeace.ltd.uk> writes

>> >My firewall has suddenly started logging *lots*
>> >of attempted connections from the Demon DNS servers from port 53,
>> >trying to connect to a variety of 4nnn ports.  
>
>Why on port 4nnn??

Some port number or other has to be used at your end, and to allow
multiple conversations to occur at once a "random" port number will be
used (clearly on this occasion selected from 4xxx values)

The firewall was not recording the outgoing packet (apparently because
of the memory leak), so the returning packet came as a surprise - so it
objected to it.

BTW I doubt it was "trying to connect" since these would have been UDP
packets with nary a TCP SYN in sight.

-- 
richard                                              Richard Clayton

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety.         Benjamin Franklin

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads