I'm sure no daemon or browser is using network resources, but I found incoming packets from Wireshark: source port 80 --TCP--> MyIp destination port 339 [SYN, ACK] source port 80 --TCP--> MyIP destination port 339 [SYN, ACK] source port 27725 --UDP--> MyIP destination port 10112 source port 27725 --UDP--> MyIP destination port 10112

I've setup deny all incoming packets in my firewall. But it seems that my firewall configuration still allow incoming from TCP port 80 and incoming to UDP port 10112.

I'm sure my IP is not initiating any connection to port 80 to that IP. I also don't have any daemons that will respond to port 339.

My question is how attacker benefits by sending packet from source port 80? What is the risk? Where can I find more detail about this kind of attack?


If I didn't block this packet by using stateful firewall and keep replying with [SYN, ACK] as defaults, what is the worst risk that could happen?

  • Are you sure your firewall is configured properly? Jan 22, 2013 at 17:45
  • @Lucas Kauffmaan: Yes, I think so because firewall already blocked many incoming to SSH and SMTP port.
    – newbie
    Jan 22, 2013 at 17:49
  • @DavidStratton or any webserver for that matter Jan 22, 2013 at 17:51
  • @DavidStratton the link show information for port 1012 but in my case, the UDP incoming packet's destination is port 10112.
    – newbie
    Jan 22, 2013 at 17:54

1 Answer 1


Since the first two packets are SYN+ACK, they look like a response to a connection attempt: the server on might be a totally honest and genuine Web server, who received a connection request (a SYN packet) on port 80, which, from the point of view of that server, was coming from your IP (and port 339). It is possible that the server is currently under a SYN flood attack and the attacker selects random IP and ports for each of its malicious SYN packets; in that case, your IP was randomly selected as purported source for one of the SYN packets.

As for the firewall, some simply block basic SYN packets, i.e. the first packet in the TCP three-way handshake. These firewalls rely on your OS to drop all others since your OS never received the initial packet to start with. This would explain why these packets reach your machine: the firewall lets them pass because it knows that the packets will be either legitimate (follow-up on a SYN packet you sent) or harmless (if you did not send a SYN packet).

As for the UDP packets, they might be responses to previous requests. Some software use a lot of UDP with randomly selected ports, Skype being the usual suspect.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .