I'm running Mac OS X and I have the system firewall enabled and I have stealth mode enabled. I opened up my system console and noticed that I'm getting tons of blocked connection attempts from places I'm not familiar with. I checked the locations of some of these addresses and some are from China and Japan. These are just a few of them, but I've got hundreds of attempted connections. I'm glad OS X is doing its job and blocking them, but is this something I should be worried about? Is this normal for a home user? What's on these ports anyways?

10/7/11 12:29:47.319 PM Firewall: Stealth Mode connection attempt to TCP from

10/7/11 12:29:48.078 PM Firewall: Stealth Mode connection attempt to TCP from

10/7/11 12:29:52.792 PM Firewall: Stealth Mode connection attempt to TCP from

10/7/11 12:29:57.067 PM Firewall: Stealth Mode connection attempt to TCP from

10/7/11 12:29:59.388 PM Firewall: Stealth Mode connection attempt to TCP from

  • 4
    How exactly are these internet facing addresses finding their way directly to your Mac located on the\24 subnet? Are you routing internet packets directly into your internal network? With a good NAT-Firewall at your internet border, you should NEVER see these packets on your system. – MToecker Oct 7 '11 at 21:54

Yes, it is normal background noise. Those addresses are most likely belonging to infected computers that are trying to infect more computers.

If you have too much time you can do a whois query (web frontend) and contact the service providers telling them about the infected machines.

But the best approach is to disable logging of rejected connection attempts and ignore them. They are just burying the important messages.


I've found that googling the port numbers (e.g. a search for "tcp 49741") will often lead you to a reference that will tell you which trojans/backdoors listen on those ports. E.g. Port 49741 at SANS -- though it doesn't have any information for this particular port beyond recent scan frequency.

The last time I checked my internet-facing firewall logs, there were tons of these kind of connection attempts. These are probably automated scans coming from bots that are scanning for vulnerable machines to take over. These are constant noise.

The connection attempts you have to worry about are those that aren't being stopped by your firewall. I'm not familiar with OS X's stealth mode -- what services do you have open that are exposed to the WAN? Are they knocking on TCP 22 (SSH)? Do you have rate limiting enabled in your firewall for port 22?

Also, did you rewrite your IP address for pasting into the question, or is there WAN traffic being forwarded to your NAT address? If the latter, it would be worth activating the filter on your router so that there isn't so much hostile traffic entering your LAN. Only forward the services that are absolutely necessary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.