Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a user on my work network who brings her personal laptop (macbook) in for work. They've been having some horrendously slow network issues on everything past that hub, so I did some packet sniffing and log checking on my firewall.

I'm showing hundreds (probably moving towards thousands now) of packets sent from her computer to the gateway/firewall (watchguard firebox). The packets all have the same source port - 10101 - and seem to be incrementing their destination port by 25 each time.

The user certainly isn't techy enough to have intentionally started any sort of port scanner, which leads me to believe there is either something buggy on her computer, or there is some sort of malware trying to poke holes in my network. Does anyone have some ideas about what might be causing this sort of network traffic? Should I be worried about it?

For reference, here is what the log strings look like from my firewall interface:

2011-11-16 08:03:01 Deny 10101/tcp 63416 10101 1-PACNT Firebox Denied 64 64 (Unhandled Internal Packet-00)  proc_id="firewall" rc="101" tcp_info="offset 11 S 293987549 win 192"    Traffic

As of now, the destination port (63416) has incremented from 58300 to 63416.

Update 1: Got some help in chat that suggests this may be a trojan sitting on her parallels install. Link:

share|improve this question
I've experienced far worse with: (a.) the first Windows 7 PC added to a department, and (b.) adding a 'workgroup' and ANY windows PC to a Linux cluster of machines. And NO, they did not appear to be infected OR incorrectly behaving. – david6 Nov 21 '11 at 20:47

Short and simple:

The symptoms that you described fits myscan, read about it here (search for 10101).

You should run a bot-scanning tool and mitigate it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.