I've got a user on my work network who brings her personal laptop (macbook) in for work. They've been having some horrendously slow network issues on everything past that hub, so I did some packet sniffing and log checking on my firewall.
I'm showing hundreds (probably moving towards thousands now) of packets sent from her computer to the gateway/firewall (watchguard firebox). The packets all have the same source port - 10101 - and seem to be incrementing their destination port by 25 each time.
The user certainly isn't techy enough to have intentionally started any sort of port scanner, which leads me to believe there is either something buggy on her computer, or there is some sort of malware trying to poke holes in my network. Does anyone have some ideas about what might be causing this sort of network traffic? Should I be worried about it?
For reference, here is what the log strings look like from my firewall interface:
2011-11-16 08:03:01 Deny 220.127.116.11 18.104.22.168 10101/tcp 63416 10101 1-PACNT Firebox Denied 64 64 (Unhandled Internal Packet-00) proc_id="firewall" rc="101" tcp_info="offset 11 S 293987549 win 192" Traffic
As of now, the destination port (63416) has incremented from 58300 to 63416.
Update 1: Got some help in chat that suggests this may be a trojan sitting on her parallels install. Link: http://chat.stackexchange.com/transcript/message/2445373#2445373