Security Incidents mailing list archives

Weird Incoming IP's and port numbers.


From: "West P." <god-admin () home com>
Date: Sun, 26 Aug 2001 22:21:01 -0400

I'm using @home internet cable.  I have the linksys cable router + 4 port
switch.  This splits the connection to 3 computers in the house.  DHCP is
turned off.  The Internal IPs are 192.168.1.x  (2,3,4)... Over the past day
I received a couple of weird INCOMING entries in the log.

DATE           TIME        SCR       SCR_PORT      DEST         DEST_PORT
08/25/2001 13:24:52  192.168.1.8      80          <my ip address>      3976
08/25/2001 19:04:42  192.168.1.16    80         <my ip address>       4319
08/25/2001 23:25:38  192.168.1.9      80          <my ip address>      4450

How is it possible that these are coming into the router from the outside?
Is this an error on the router?  Do any of these ports seem familiar.

Extra note:  When I tried to make a connection with these ports from within
my network it refused the connection and didn't put it in the incoming or
outgoing log.

Is there an explanation for this?


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com


Current thread: