1

I was browsing through my home network linksys router logs today and noticed an incoming connection from 41.212.36.114 to port 44543. I checked out this IP address at it's coming from Kenya. I'm in the USA and don't know anyone or any service that I use based in Africa. In addition, I found another African IP address hitting this same specific port. In addition, I looked at my port forwarding on my router and I don't see anywhere on the linksys EA9200 where I have port 44543 open, but sure enough, when I use a publicly available web-based port scanner, it shows this port is open.

I'm obviously not super network knowledgeable (probably know enough to be dangerous as they say), but now these logs have me a little worried. The EA9200, I'm finding out, is pretty bad since I can't seem to maintain historical logs in a a log file from the router (beyond about 20 entries) and apparently, I can't blacklist IP addresses and have no idea how this port is open.

So my question to this community is, what steps could I take, to (1) determine if my network was compromised with such terrible LINKSYS logging (e.g. someone got into the network and took anything or did something nefarious such as browsing personal documents) and (2) determine why or how this port is open since I haven't explicitly opened this port up and (3) how to close this port since it is apparently, open.

If there are questions or you'd need more info, I'm happy to update the post as needed.

Thanks.

UPDATE:

My main computer is running Windows 10, Version 1703 (OS Build 15063.540). However, I have a number of other devices on the network that use various Linux distros and android.

My ISP is Comcast Business Class.

|improve this question
  • 1
    What OS do you use? – Mirsad Sep 12 '17 at 16:10
  • Windows 10, Version 1703 (OS Build 15063.540). I'll update the main post. – StatsStudent Sep 12 '17 at 16:10
3

First you have to check which process is running or using that port. How can you do that:

netstat -a -b

You can use also TCPView.

enter image description here

Than make sure that running process is not affected by any security issue.

Attackers are just scanning randomly and trying to find new victims.

To keep them away use firewall or IPS/IDS.

|improve this answer
  • Great! I think you helped me pin this down. It looks like that port is being used by Skype. My Firewall is in place and I guess it's time to invest in a new, more advanced router than home Linksys. I'd be curious to hear recommendations on routers that include logging features. – StatsStudent Sep 12 '17 at 16:49
  • Unfortunately, product recommendations are considered "off topic" on the Stack Exchange sites. This helps limit people from spamming the answers with spamvertisements like "Product X will solve all your problems!" So you'll have to do research on different products elsewhere. Fortunately, Google is just a click away... :-) – John Deters Sep 12 '17 at 17:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.