euphoria3
join:2005-10-07
UK
1 edit | Constant access attempts on my router
Is it normal for an always-on connection to get a fairly regular number of access attempts by unwanted parties?
I am protected by a NAT router & software firewalls, but my router is reporting a reoccurring stream of blocked access attempts. It would seem to be a port scanner of sorts as it generally tries to gain access to ports that may be vulnerable on outdated windows boxes.
A snippet of the log is as follows:
01 December 2004 00:32:18 Blocked access attempt from 202.99.172.138:38045 to UDP port 102
*6
01 December 2004 00:32:18 Blocked access attempt from 202.99.172.138:38045 to UDP port 102
*7
01 December 2004 00:36:17 Blocked access attempt from 221.10.158.140:36106 to UDP port 102
*6
01 December 2004 00:36:17 Blocked access attempt from 221.10.158.140:36106 to UDP port 102
*7
01 December 2004 00:36:47 Blocked access attempt from 61.147.119.222:47779 to UDP port 102
*6
01 December 2004 00:39:58 Blocked access attempt from 202.99.172.160:59309 to UDP port 102
*6
01 December 2004 00:40:33 Blocked access attempt from 202.111.173.43:55060 to UDP port 102
*7
01 December 2004 00:40:57 Blocked access attempt from 221.5.251.218:41571 to UDP port 1026
01 December 2004 00:40:57 Blocked access attempt from 221.5.251.218:41571 to UDP port 1027
01 December 2004 00:46:13 Blocked access attempt from 219.157.19.157:34866 to UDP port 102
*8
01 December 2004 00:46:13 Blocked access attempt from 219.157.19.157:34866 to UDP port 102
*9
01 December 2004 00:48:33 Blocked access attempt from 81.174.203.28:1291 to TCP port 1433
01 December 2004 00:48:35 Blocked access attempt from 81.174.203.28:1291 to TCP port 1433
01 December 2004 00:49:20 Blocked access attempt from 222.77.185.228:55042 to UDP port 103
*0
01 December 2004 00:59:06 Blocked access attempt from 212.136.23.103:13783 to UDP port 102
*6
01 December 2004 01:00:23 Blocked access attempt from 81.174.209.176:2075 to TCP port 139
01 December 2004 01:00:26 Blocked access attempt from 81.174.209.176:2075 to TCP port 139
(*) WARNING 11 long line(s) split
I have checked all machines on my network for virus/spyware infection, showed up all clean.
My questions are:
is this normal activity on a home connection?
Does all these access attempts slow my connection?
Should I be concerned?
Is there anything I can do (without changing my IP)?
Thanks for any advice you can offer. |
|
Daniel
Premium,MVM
join:2000-06-26
Pleasanton, CA
clubs: 
| You're just seeing what's going on all over the Internet 24 hours a day. It's background noise -- nothing to worry about. 
--
dmiessler.com -- grep understanding knowledge |
|
euphoria3
join:2005-10-07
UK | Ok great thanks. Being 'not so-much in the know', I was getting a little worried I was being targetting or something.
apreciate it. |
|
