2

I was recommended by my brother to direct the question here about the level of traffic I get against several of my blocked ports.

I run pfsense 1.2.3, router in bridge.

Behind pfsense I have:

1x desktop windows 7

1x Linux ubuntu running web(about 50MB transfered/day) and ftp service(filtered) and mumble (used by about 10 users)

For the past weeks I have noticed an increased of hosts trying to send UDP packets to mainly 1 port at a time. Suddenly the port they try to send to is changed and I barely notice any traffic to the previous port.

I have not noticed an increase of traffic on my web ports. Snort have only blocked 2 hosts in a 1 week period (but not related as I can not find that host in my fw logs).

A graphical representation (splunk) of where the traffic comes from: http://imageshack.us/photo/my-images/580/fwgooglemaps.png/

Graphical representation of the destination ports (from pfsense): http://imageshack.us/photo/my-images/684/fwdestinationports.png/

Pfsense firewall log 10 sec window: Myip = my public ip

Act Time If Source Destination Proto

block
Jun 2 18:06:29  WAN     64.138.215.209:51006    myip:39742  UDP

block
Jun 2 18:06:29  WAN     75.74.191.228:56536     myip:39742  UDP

block
Jun 2 18:06:29  WAN     71.97.88.119:60280  myip:39964  UDP

block
Jun 2 18:06:29  WAN     200.66.22.53:64460  myip:14330  TCP:S

block
Jun 2 18:06:29  WAN     71.97.88.119:60280  myip:39964  UDP

block
Jun 2 18:06:29  WAN     190.19.28.235:51596     myip:39742  UDP

block
Jun 2 18:06:29  WAN     71.81.141.168:55162     myip:39742  UDP

block
Jun 2 18:06:29  WAN     174.22.195.82:56563     myip:39742  UDP

block
Jun 2 18:06:29  WAN     173.10.101.85:64192     myip:39742  UDP

block
Jun 2 18:06:29  WAN     173.10.101.85:64192     myip:8421   UDP

block
Jun 2 18:06:29  WAN     71.183.199.18:61628     myip:59926  UDP

block
Jun 2 18:06:29  WAN     174.117.250.116:51043   myip:61456  UDP

block
Jun 2 18:06:29  WAN     174.17.103.40:63717     myip:39742  UDP

block
Jun 2 18:06:29  WAN     88.112.30.149:50687     myip:39742  UDP

block
Jun 2 18:06:29  WAN     77.255.52.131:64571     myip:21562  UDP

block
Jun 2 18:06:28  WAN     88.193.136.78:52641     myip:39742  UDP

block
Jun 2 18:06:28  WAN     178.233.159.4:54898     myip:19292  UDP

block
Jun 2 18:06:28  WAN     41.178.85.161:51807     myip:33120  UDP

block
Jun 2 18:06:28  WAN     94.75.217.65:50811  myip:39742  UDP

block
Jun 2 18:06:28  WAN     80.216.224.177:53614    myip:39742  UDP

block
Jun 2 18:06:28  WAN     213.250.20.37:64348     myip:36679  UDP

block
Jun 2 18:06:28  WAN     213.250.20.37:64348     myip:39742  UDP

block
Jun 2 18:06:28  WAN     69.125.208.145:55006    myip:5578   UDP

block
Jun 2 18:06:28  WAN     217.211.20.50:33997     myip:39742  UDP

block
Jun 2 18:06:28  WAN     82.24.89.58:49503   myip:39742  UDP

block
Jun 2 18:06:28  WAN     81.167.166.54:54849     myip:39742  UDP

block
Jun 2 18:06:28  WAN     64.138.215.209:51006    myip:39742  UDP

block
Jun 2 18:06:28  WAN     207.81.19.175:28173     myip:39742  UDP

block
Jun 2 18:06:27  WAN     85.224.132.107:55287    myip:39742  UDP

block
Jun 2 18:06:27  WAN     188.25.158.197:50577    myip:39742  UDP

block
Jun 2 18:06:27  WAN     86.145.253.68:51761     myip:39742  UDP

block
Jun 2 18:06:27  WAN     81.232.117.179:50028    myip:11821  UDP

block
Jun 2 18:06:27  WAN     174.17.103.40:63717     myip:39742  UDP

block
Jun 2 18:06:27  WAN     85.246.187.226:51806    myip:47479  UDP

block
Jun 2 18:06:27  WAN     85.246.187.226:51806    myip:47479  UDP

block
Jun 2 18:06:27  WAN     201.239.118.50:51314    myip:31642  UDP

block
Jun 2 18:06:27  WAN     190.19.28.235:51596     myip:39742  UDP

block
Jun 2 18:06:27  WAN     174.22.195.82:56563     myip:39742  UDP

block
Jun 2 18:06:27  WAN     173.10.101.85:64192     myip:8421   UDP

block
Jun 2 18:06:27  WAN     173.10.101.85:64192     myip:39742  UDP

block
Jun 2 18:06:27  WAN     71.183.199.18:61628     myip:59926  UDP

block
Jun 2 18:06:27  WAN     88.112.30.149:50687     myip:39742  UDP

block
Jun 2 18:06:27  WAN     94.209.63.79:49212  myip:39742  UDP

block
Jun 2 18:06:27  WAN     207.81.19.175:28173     myip:39742  UDP

block
Jun 2 18:06:27  WAN     85.246.187.226:51806    myip:47479  UDP

block
Jun 2 18:06:26  WAN     81.216.152.237:53794    myip:39742  UDP

block
Jun 2 18:06:26  WAN     88.193.136.78:52641     myip:39742  UDP

block
Jun 2 18:06:26  WAN     86.27.166.14:58647  myip:39742  UDP

block
Jun 2 18:06:26  WAN     71.97.88.119:60280  myip:39964  UDP

block
Jun 2 18:06:26  WAN     178.233.159.4:54898     myip:19292  UDP

block
Jun 2 18:06:26  WAN     99.7.194.178:58149  myip:63805  UDP

block
Jun 2 18:06:26  WAN     41.178.85.161:51807     myip:33120  UDP

block
Jun 2 18:06:26  WAN     46.22.108.9:59119   myip:39742  UDP

block
Jun 2 18:06:26  WAN     213.250.20.37:64348     myip:36679  UDP

block
Jun 2 18:06:26  WAN     213.250.20.37:64348     myip:39742  UDP

block
Jun 2 18:06:26  WAN     80.216.224.177:53614    myip:39742  UDP

block
Jun 2 18:06:26  WAN     69.125.208.145:55006    myip:5578   UDP

block
Jun 2 18:06:26  WAN     82.24.89.58:49503   myip:39742  UDP

block
Jun 2 18:06:26  WAN     81.167.236.82:49879     myip:39742  UDP

block
Jun 2 18:06:26  WAN     64.138.215.209:51006    myip:39742  UDP

block
Jun 2 18:06:25  WAN     69.60.239.30:58926  myip:39742  UDP

block
Jun 2 18:06:25  WAN     85.224.132.107:55287    myip:39742  UDP

block
Jun 2 18:06:25  WAN     188.25.158.197:50577    myip:39742  UDP

block
Jun 2 18:06:25  WAN     86.145.253.68:51761     myip:39742  UDP

block
Jun 2 18:06:25  WAN     83.248.112.103:61403    myip:39742  UDP

block
Jun 2 18:06:25  WAN     174.22.195.82:56563     myip:39742  UDP

block
Jun 2 18:06:25  WAN     65.95.191.25:54535  myip:39742  UDP

block
Jun 2 18:06:25  WAN     71.183.199.18:61628     myip:59926  UDP

block
Jun 2 18:06:25  WAN     201.239.118.50:51314    myip:31642  UDP

block
Jun 2 18:06:25  WAN     213.216.240.106:63529   myip:39742  UDP

block
Jun 2 18:06:25  WAN     212.127.175.2:62522     myip:39742  UDP

block
Jun 2 18:06:25  WAN     94.209.63.79:49212  myip:39742  UDP

block
Jun 2 18:06:24  WAN     68.111.150.38:55780     myip:39742  UDP

block
Jun 2 18:06:24  WAN     67.212.10.165:53884     myip:39742  UDP

block
Jun 2 18:06:24  WAN     81.216.152.237:53794    myip:39742  UDP

block
Jun 2 18:06:24  WAN     86.27.166.14:58647  myip:39742  UDP

block
Jun 2 18:06:24  WAN     188.126.95.87:56225     myip:59544  TCP:S

block
Jun 2 18:06:24  WAN     69.11.67.190:55308  myip:30954  UDP

block
Jun 2 18:06:24  WAN     41.178.85.161:51807     myip:33120  UDP

block
Jun 2 18:06:24  WAN     178.233.159.4:54898     myip:19292  UDP

block
Jun 2 18:06:24  WAN     46.22.108.9:59119   myip:39742  UDP

block
Jun 2 18:06:24  WAN     80.216.224.177:53614    myip:39742  UDP

block
Jun 2 18:06:24  WAN     69.125.208.145:55006    myip:5578   UDP

block
Jun 2 18:06:24  WAN     82.24.89.58:49503   myip:39742  UDP

block
Jun 2 18:06:24  WAN     81.167.236.82:49879     myip:39742  UDP

block
Jun 2 18:06:24  WAN     14.200.71.237:58390     myip:39742  UDP

block
Jun 2 18:06:24  WAN     113.159.45.49:60668     myip:39742  UDP

block
Jun 2 18:06:23  WAN     69.60.239.30:58926  myip:39742  UDP

block
Jun 2 18:06:23  WAN     82.226.63.164:54431     myip:32876  UDP

block
Jun 2 18:06:23  WAN     85.224.132.107:55287    myip:39742  UDP

block
Jun 2 18:06:23  WAN     188.25.158.197:50577    myip:39742  UDP

block
Jun 2 18:06:23  WAN     86.145.253.68:51761     myip:39742  UDP

block
Jun 2 18:06:23  WAN     83.248.112.103:61403    myip:39742  UDP

block
Jun 2 18:06:23  WAN     71.97.88.119:60280  myip:39964  UDP

block
Jun 2 18:06:23  WAN     173.171.72.148:62866    myip:43189  UDP

block
Jun 2 18:06:23  WAN     217.211.20.50:33997     myip:39742  UDP

block
Jun 2 18:06:23  WAN     65.95.191.25:54535  myip:39742  UDP

block
Jun 2 18:06:23  WAN     98.234.156.149:50360    myip:36672  UDP

block
Jun 2 18:06:23  WAN     91.152.224.218:57511    myip:39742  UDP

block
Jun 2 18:06:23  WAN     212.127.175.2:62522     myip:39742  UDP

block
Jun 2 18:06:23  WAN     46.9.191.184:51688  myip:39742  UDP

block
Jun 2 18:06:23  WAN     213.216.240.106:63529   myip:39742  UDP

block
Jun 2 18:06:23  WAN     82.20.25.96:57124   myip:39742  UDP

block
Jun 2 18:06:23  WAN     94.209.63.79:49212  myip:39742  UDP

block
Jun 2 18:06:22  WAN     77.45.54.72:33674   myip:25998  UDP

block
Jun 2 18:06:22  WAN     68.111.150.38:55780     myip:39742  UDP

block
Jun 2 18:06:22  WAN     77.45.54.72:33552   myip:25998  UDP

block
Jun 2 18:06:22  WAN     67.212.10.165:53884     myip:39742  UDP

block
Jun 2 18:06:22  WAN     81.216.152.237:53794    myip:39742  UDP

block
Jun 2 18:06:22  WAN     213.227.110.194:64370   myip:39742  UDP

block
Jun 2 18:06:22  WAN     83.254.247.72:52170     myip:39742  UDP

block
Jun 2 18:06:22  WAN     95.176.138.42:64914     myip:39742  UDP

block
Jun 2 18:06:22  WAN     86.27.166.14:58647  myip:39742  UDP

block
Jun 2 18:06:22  WAN     202.71.88.116:56045     myip:39742  UDP

block
Jun 2 18:06:22  WAN     201.239.118.50:51314    myip:31642  UDP

block
Jun 2 18:06:22  WAN     202.71.88.116:56045     myip:34798  UDP

block
Jun 2 18:06:22  WAN     202.71.88.116:56045     myip:39742  UDP

block
Jun 2 18:06:22  WAN     213.243.140.160:53709   myip:6027   UDP

block
Jun 2 18:06:22  WAN     46.22.108.9:59119   myip:39742  UDP

block
Jun 2 18:06:22  WAN     75.74.191.228:56536     myip:39742  UDP

block
Jun 2 18:06:22  WAN     64.228.157.39:59376     myip:39742  UDP

block
Jun 2 18:06:22  WAN     201.239.118.50:51314    myip:31642  UDP

block
Jun 2 18:06:22  WAN     81.167.236.82:49879     myip:39742  UDP

block
Jun 2 18:06:22  WAN     14.200.71.237:58390     myip:39742  UDP

block
Jun 2 18:06:22  WAN     76.126.240.94:62943     myip:39198  UDP

block
Jun 2 18:06:22  WAN     113.159.45.49:60668     myip:39742  UDP

block
Jun 2 18:06:21  WAN     69.60.239.30:58926  myip:39742  UDP

block
Jun 2 18:06:21  WAN     82.226.63.164:54431     myip:32876  UDP

block
Jun 2 18:06:21  WAN     83.248.112.103:61403    myip:39742  UDP

block
Jun 2 18:06:21  WAN     188.126.95.87:56225     myip:59544  TCP:S

block
Jun 2 18:06:21  WAN     76.126.240.94:62943     myip:38231  UDP

block
Jun 2 18:06:21  WAN     217.211.20.50:33997     myip:39742  UDP

block
Jun 2 18:06:21  WAN     65.95.191.25:54535  myip:39742  UDP

block
Jun 2 18:06:21  WAN     71.81.141.168:55162     myip:39742  UDP

block
Jun 2 18:06:21  WAN     98.234.156.149:50360    myip:36672  UDP

block
Jun 2 18:06:21  WAN     213.216.240.106:63529   myip:39742  UDP

block
Jun 2 18:06:21  WAN     91.152.224.218:57511    myip:39742  UDP

block
Jun 2 18:06:21  WAN     46.9.191.184:51688  myip:39742  UDP

block
Jun 2 18:06:21  WAN     82.20.25.96:57124   myip:39742  UDP

block
Jun 2 18:06:21  WAN     212.127.175.2:62522     myip:39742  UDP

block
Jun 2 18:06:21  WAN     77.255.52.131:64571     myip:21562  UDP

block
Jun 2 18:06:21  WAN     85.226.13.36:54604  myip:28364  UDP

block
Jun 2 18:06:21  WAN     85.226.13.36:54604  myip:28364  UDP

block
Jun 2 18:06:20  WAN     77.45.54.72:33674   myip:25998  UDP

block
Jun 2 18:06:20  WAN     77.45.54.72:33553   myip:25998  UDP

block
Jun 2 18:06:20  WAN     68.111.150.38:55780     myip:39742  UDP

block
Jun 2 18:06:20  WAN     67.212.10.165:53884     myip:39742  UDP

block
Jun 2 18:06:20  WAN     70.72.51.17:60899   myip:28211  UDP

block
Jun 2 18:06:20  WAN     83.254.247.72:52170     myip:39742  UDP

block
Jun 2 18:06:20  WAN     95.176.138.42:64914     myip:39742  UDP

block
Jun 2 18:06:20  WAN     213.227.110.194:64370   myip:39742  UDP

block
Jun 2 18:06:20  WAN     71.97.88.119:60280  myip:39964  UDP

block
Jun 2 18:06:20  WAN     71.97.88.119:60280  myip:39964  UDP

block
Jun 2 18:06:20  WAN     70.72.51.17:60899   myip:9022   UDP

block
Jun 2 18:06:20  WAN     85.226.13.36:54604  myip:28364  UDP

block
Jun 2 18:06:20  WAN     71.97.88.119:60280  myip:39964  UDP

block
Jun 2 18:06:20  WAN     202.71.88.116:56045     myip:34798  UDP

block
Jun 2 18:06:20  WAN     202.71.88.116:56045     myip:39742  UDP

block
Jun 2 18:06:20  WAN     94.75.217.65:50811  myip:39742  UDP

block
Jun 2 18:06:20  WAN     75.74.191.228:56536     myip:39742  UDP

block
Jun 2 18:06:20  WAN     64.228.157.39:59376     myip:39742  UDP

block
Jun 2 18:06:20  WAN     81.167.166.54:54849     myip:39742  UDP

block
Jun 2 18:06:20  WAN     14.200.71.237:58390     myip:39742  UDP

The port changed to 39742 2 days ago. I don't recall the port before that, but it was different. Curious when the requests will change port again.

Should I be concerned by this? Is this normal? Any help greatly appreciated

Thanks

Improve this question

2 Answers 2

Reset to default
2

To get general information on popular target ports you can check out SANS Internet Storm Center.

The SANS Internet Storm Center (ISC) uses advanced data correlation and visualization techniques to analyze data collected from thousands of sensors in over sixty countries.

Top 10 Targets: http://isc.sans.org/reports.html

To check reports of attacks against port 39742, you can do this query:
http://isc.sans.org/port.html?port=39742

Improve this answer
2

As long as your firewall is blocking the connections, you have nothing at all to worry about. Publicly facing internet connections will always be bombarded with random, automated scans and pings and intrusion attempts.

Improve this answer
2
  • Thanks, but is it normal that the connections suddenly change to a different port a few times a week, leaving the previous port almost idle to connections? It seems kinda "organized", maybe it's a botnet?
    – connery
    Jun 2, 2011 at 19:55
  • 1
    Less organised, more 'automated' - this is pretty much standard for every IP address on the Internet. Your choke/filter router and your firewall should be blocking these quite happily:-)
    – Rory Alsop ♦
    Jun 2, 2011 at 23:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .