Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm using Comodo Firewall and I noticed that sometimes I'm getting TCP IN connection from another IP address in my home network (only one router and few wireless users):

TCP IN | 192.168.1.50 | 192.168.1.75, where firs address is source and second one (my address) is destination. Why this is happening? Could it be a sniffer running at 192.168.1.50 computer?

share|improve this question
add comment

1 Answer

Whether it is a threat is going to depend on what services you are running on your computer, whether you are aware of them or not, and what the device at 192.168.1.50 is.

For instance, it would be okay if you are sharing files on the local network using your computer, and 192.168.1.50 is a known IP address of a client computer wanting to download files from your computer. You could also have software installed on your computer that allows network printing for instance, and that TCP connection is just your network printer doing routine communication with your computer.

Or, it could be that someone has hacked into your device on 192.168.1.50 and is probing your computer, or that there is malware listening on your computer. Maybe 192.168.1.50 belongs to a device that shouldn't be on your network in the first place...

Without context and knowledge of what's running and what every device should be doing on your network, there's little that can be determined about that connection and its intended purpose.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.