New answers tagged ports
The definition of a DMZ is that you have two firewalls, one between the system and your LAN and one between the system and the global Internet. A skilled administrator will of course configure the firewall facing the internet to only allow those services which are required by the server.
If I'm reading that log correctly, you're seeing backscatter from a spoofed-packet denial-of-service attack (possibly a SYN flood) against a webserver running on abc.a.b.c. The constant destination port and exact-multiples-of-a-minute timing is a bit odd, though. The log is showing SYN/ACK packets (that is, the second stage in a TCP three-way handshake) ...
Have you tried to telnet onto it? I had a similar Thomson router which if you telnet onto has it's own command line interface. It wasn't very intuitve, but once you get the hang of it you can figure out how to remove services.
When nmap scans a TCP port (e.g. TCP/80 for HTTP traffic) a filtered response means that nmap did not get any response to the packet it sent. The other options for TCP ports are "closed" which means that in response to the SYN packet nmap sent, the host sent a RST packet (essentially indicating that there is no service listening on that port) or "open" ...
Filtered is a loose term when it comes to nmap, in most cases it refers to a firewall guarding it. In some cases these protections may be circumvented. In your case I think it's safe to say that if your config is right, you're safe (on ports other than 80)
Top 50 recent answers are included