Reverse flow RPC?

["Daniel H. Renner" <dan () losangelescomputerhelp com>]

Hello list,

We're running IPCop v1.4.0a10 on a DHCP ADSL connection.  Snort is the
IDS software installed.

I took a look-see at my firewall log for yesterday and saw four
instances of what appears to be reversed incoming RPC traffic on the Red
(WAN/eth2) side.

I had this sort of a scenario before, but it was reversed port 80
traffic. I Googled to no avail, and I also reported it to this list and
never was able to figure our what the heck causes this type of traffic,
so when it cropped up again I'm still at a loss - any clues?

  Time       Chain      Iface Proto   Source   Src Port   
MAC Address     Destination  Dst Port
21:01:42  NEW not SYN?  eth2  TCP  4.62.174.132  1025 
00:02:3b:01:6b:ed  4.62.xxx.xxx  1820
20:29:44  NEW not SYN?  eth2  TCP  4.62.174.132  1025 
00:02:3b:01:6b:ed  4.62.xxx.xxx  1509
19:57:13  NEW not SYN?  eth2  TCP  4.62.174.132  1025 
00:02:3b:01:6b:ed  4.62.xxx.xxx  1206
19:57:47  NEW not SYN?  eth2  TCP  4.62.174.132  1025 
00:02:3b:01:6b:ed  4.62.xxx.xxx  1966

-- 


TIA,

Dan Renner
President
Los Angeles Computerhelp
http://losangelescomputerhelp.com
818.352.8700


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html