This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Help, whats this?

Anyone know what this is? I'm getting hammering on the external firewall interface:

UDP Port 26790 accounting for 42% of all dropped ports.

How could I track down whats causing it? I cant see any internal going out on that port.

Is iptraf the only way to see who is using what ports on the LAN?

This thread was automatically locked due to age.

0 BarryG over 18 years ago

Is iptraf the only way to see who is using what ports on the LAN?

TCPDump is available in recent versions of ASL.
Be careful, it creates a lot of output and can therefore use a lot of bandwidth if you're connect via SSH.

TEthereal / TShark has a "top talkers" report, but it's not installed on ASL.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 18 years ago

there's a new worm out there. I'm not home to analyze this but than traffic could be the worm trying to get in from the outside.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 18 years ago in reply to William Warren

In the case of worms, sometimes it is a good idea to create a rule to drop this traffic without logging, to avoid making the logs too big and making a lot of work for the reporting tools.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Shaw over 18 years ago in reply to BarryG

Was a trojan...
Cancel
Vote Up 0 Vote Down

Cancel