I've got a user on my work network who brings her personal laptop (macbook) in for work. They've been having some horrendously slow network issues on everything past that hub, so I did some packet sniffing and log checking on my firewall.

I'm showing hundreds (probably moving towards thousands now) of packets sent from her computer to the gateway/firewall (watchguard firebox). The packets all have the same source port - 10101 - and seem to be incrementing their destination port by 25 each time.

The user certainly isn't techy enough to have intentionally started any sort of port scanner, which leads me to believe there is either something buggy on her computer, or there is some sort of malware trying to poke holes in my network. Does anyone have some ideas about what might be causing this sort of network traffic? Should I be worried about it?

For reference, here is what the log strings look like from my firewall interface:

2011-11-16 08:03:01 Deny 10101/tcp 63416 10101 1-PACNT Firebox Denied 64 64 (Unhandled Internal Packet-00)  proc_id="firewall" rc="101" tcp_info="offset 11 S 293987549 win 192"    Traffic

As of now, the destination port (63416) has incremented from 58300 to 63416.

Update 1: Got some help in chat that suggests this may be a trojan sitting on her parallels install. Link: http://chat.stackexchange.com/transcript/message/2445373#2445373

  • I've experienced far worse with: (a.) the first Windows 7 PC added to a department, and (b.) adding a 'workgroup' and ANY windows PC to a Linux cluster of machines. And NO, they did not appear to be infected OR incorrectly behaving.
    – david6
    Commented Nov 21, 2011 at 20:47

1 Answer 1


Short and simple:

The symptoms that you described fits myscan, read about it here (search for 10101).

You should run a bot-scanning tool and mitigate it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .