Incoming Packet From Source Port 80

Question

I'm sure no daemon or browser is using network resources, but I found incoming packets from Wireshark:

98.126.43.174 source port 80 --TCP--> MyIp destination port 339 [SYN, ACK]
98.126.43.174 source port 80 --TCP--> MyIP destination port 339 [SYN, ACK]
67.11.225.49 source port 27725 --UDP--> MyIP destination port 10112
67.11.225.49 source port 27725 --UDP--> MyIP destination port 10112

I've setup deny all incoming packets in my firewall. But it seems that my firewall configuration still allow incoming from TCP port 80 and incoming to UDP port 10112.

I'm sure my IP is not initiating any connection to port 80 to that IP. I also don't have any daemons that will respond to port 339.

My question is how attacker benefits by sending packet from source port 80? What is the risk? Where can I find more detail about this kind of attack?

REVISE:

If I didn't block this packet by using stateful firewall and keep replying with [SYN, ACK] as defaults, what is the worst risk that could happen?

Answer 1

Since the first two packets are SYN+ACK, they look like a response to a connection attempt: the server on 98.126.43.174 might be a totally honest and genuine Web server, who received a connection request (a SYN packet) on port 80, which, from the point of view of that server, was coming from your IP (and port 339). It is possible that the server 98.126.43.174 is currently under a SYN flood attack and the attacker selects random IP and ports for each of its malicious SYN packets; in that case, your IP was randomly selected as purported source for one of the SYN packets.

As for the firewall, some simply block basic SYN packets, i.e. the first packet in the TCP three-way handshake. These firewalls rely on your OS to drop all others since your OS never received the initial packet to start with. This would explain why these packets reach your machine: the firewall lets them pass because it knows that the packets will be either legitimate (follow-up on a SYN packet you sent) or harmless (if you did not send a SYN packet).

As for the UDP packets, they might be responses to previous requests. Some software use a lot of UDP with randomly selected ports, Skype being the usual suspect.