0

I just went to have a look through some router settings today and found an unknown new entry in the NAT table, forwarding UDP port 1052 to the same port on a host which runs both Windows 7 and Linux. I disabled the rule and have asked the ISP if they have added it, which is unlikely because of the name of the NAT rule. I've looked around and could find only two references to this name which seem relevant (possibly NSFW): a Reddit post (referring to port 1057) and a decompiled binary with no context. I also checked netstat on both OSes and found no service listening on UDP port 1052 (although a sophisticated hack could of course hide itself). I had a quick look in Wireshark as well but found no traffic to that port.

The router an ISP-provided NetComm Wireless NF4V. It doesn't get firmware updates.

Is this a known virus/worm? Is there anything else I should do?

  • Is UPnP enabled on your router? If so software on your machine may have requested the router to forward that port – sguerrini97 Feb 23 at 12:09
  • @sguerrini97 UPnP is disabled, but I don't know when I disabled it — these things are usually enabled by default on consumer routers. – l0b0 Feb 23 at 17:02
0

Iana.org port list includes 1052 tcp/udp as a Dynamic DNS linked port. This may make sense if you consider that DNS port is 53 traditionally, and 52 is close, as is 1052. This is how ports are selected when people try to choose a different port to make access less than trivial but associate it with some service (like 8080 instead of 80 or port 81 instead of 80). Chances are someone selected 1052 as a DNS linked port.

Also, chances are you played with DDNS in the past. Just guessing.

  • Your answer makes no sense to me. Most DDNS-style things runs over http(s). And there's no reason to have incoming traffic for DDNS to work - unless you are running an authoritative nameserver, in which case 1052 doesn't make sense. – vidarlo Mar 25 at 21:13
  • sure, but you could google Debian ddt-client things and the fact that the iana.org entry was created by Remy Lefbvre who is or was a Debian contributor, and it may make a little bit more sense. for example: marc.info/?l=debian-user&m=102235935405847&w=2 – HackneyB Apr 1 at 2:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.