I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these automated scans, PC's with malware or are we under some kind of attack?
Most of these Ip's are not from the United States, I've seen Russia, S. Korea, and Pakistan plus other countries. I deleted the log and it instantly started filling back up.
Also what should be the next step, I'm going to see if this firewall has some kind of a log that shows connections inside trying to go out, or active connections. It's a Zywall USG 50.
It's been an hour and firewall has been hit 289 times, that doesn't count multiple packets being dropped (as in drop= 2,3,4ect).
so the only weird thing I can find, is weird UDP traffic on port 80 for the DMZ that I did not set up. I'll speak with the client's tomorrow and see if they know what is on the DMZ (they will not smh). Other then that I do have a large ammount of traffic hitting the firewall on port 53 but no of the active connections/sessions or data I logged on the network seem to point to anything.