This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Bogus Traffic Going To Non-Existent Destination?

I had two rules setup awhile ago for something like limewire.  Allowing both incoming/outgoing traffic for my computer and then my computer downstairs.

Well, I don't use my computer downstairs anymore really, so I just disabled those packet rules I created so they are RED.  That computer is 192.168.1.9

That computer has been off for 3 weeks yet I still see traffic in my log constantly like below:   Why would that be occuring?

20:41:51 Default DROP UDP
89.222.181.83 : 50835
→
192.168.1.9 : 6346

len=131 ttl=108 tos=0x00 srcmac=00:08:02:ef:ac:47 dstmac=00:17:9a:bd:2a:0e
20:41:53 Default DROP UDP
147.197.190.60 : 27405
→
192.168.1.9 : 6346

len=131 ttl=105 tos=0x00 srcmac=00:08:02:ef:ac:47 dstmac=00:17:9a:bd:2a:0e
20:41:55 Default DROP UDP
79.32.84.47 : 41426
→
192.168.1.9 : 6346

len=131 ttl=109 tos=0x00 srcmac=00:08:02:ef:ac:47 dstmac=00:17:9a:bd:2a:0e
20:41:56 Default DROP UDP
76.67.180.64 : 43659
→
192.168.1.9 : 6346

len=131 ttl=113 tos=0x00 srcmac=00:08:02:ef:ac:47 dstmac=00:17:9a:bd:2a:0e
20:41:57 Default DROP UDP
195.211.204.135 : 6881
→
192.168.1.9 : 6346

This thread was automatically locked due to age.

0 BAlfson over 15 years ago

Run those IPs past the following, and I think you'll see that allowing unproxied incoming traffic invites the bad guys...

Check IP Reputation | Commtouch - Messaging and Web Security Technology

Free online network utilities - traceroute, nslookup, automatic whois lookup, ping, finger (Click on 'Domain Dossier')

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 chugger93 over 15 years ago

I dont get what the domain dossier is showing, but the other site, said my IP was suspucious.  Hmmm... I had a trojan on my PC about 8 months ago using it as an email relay, but cleaned it out long ago.  Comcast shut down my port 25 and I had to use 587.  So ya I'm clean nowadays.

I guess I'm still confused.  Did this trojan I had awhile ago have something to do with the traffic that is getting dropped currently you think?

Or does it have something to do with the fact that I'm currently using limewire right now on my other PC 192.168.1.3 which is allowing traffic through that port to that IP only.  But maybe somehow the peers know this and they are trying to get traffic to 192.168.1.9 (my computer downstairs that's shutoff) ?
Cancel
Vote Up 0 Vote Down

Cancel
0 chugger93 over 15 years ago

FYI: I had a DNAT rule there that was GREEN and live, even tho my packet filter rule was RED and turned off. So when I turned off the DNAT rule, I don't see the traffic anymore. [;)]
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 15 years ago

Thanks for coming back and giving us the rest of the story!

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 15 years ago

Well, you should set the DNAT to point to the other PC running limewire if you want limewire to work well.

FWIW, even after you turn off a p2p app, you will see lots of hits against your firewall, as peers are still trying to connect. It's not harmful though.

Barry
Cancel
Vote Up 0 Vote Down

Cancel