I'm sure no daemon or browser is using network resources, but I found incoming packets from Wireshark:
184.108.40.206 source port 80 --TCP--> MyIp destination port 339 [SYN, ACK] 220.127.116.11 source port 80 --TCP--> MyIP destination port 339 [SYN, ACK] 18.104.22.168 source port 27725 --UDP--> MyIP destination port 10112 22.214.171.124 source port 27725 --UDP--> MyIP destination port 10112
I've setup deny all incoming packets in my firewall. But it seems that my firewall configuration still allow incoming from TCP port 80 and incoming to UDP port 10112.
I'm sure my IP is not initiating any connection to port 80 to that IP. I also don't have any daemons that will respond to port 339.
My question is how attacker benefits by sending packet from source port 80? What is the risk? Where can I find more detail about this kind of attack?
If I didn't block this packet by using stateful firewall and keep replying with [SYN, ACK] as defaults, what is the worst risk that could happen?