Whats going on with my network?



  • Sorry of this is the wrong spot for this, but I thought it is most appropriate as its not a feature problem, nor a configuration problem.

    For the past few days, I have had thousands of UDP access attempts to my firewall box on random ports, all from random IP's and it has been going on consistently for a few days now. I am wondering if anyone could shed some light on what is going on here? Possibly just a portscan?

    Attached is a snippit of what my firewall log is full of.

    Currently there is no slowdown on my network, and all of my server's seem fine, I just find this very odd…



  • Netgate Administrator

    Probably your WAN connection has been given an IP that previously had been hosting some file sharing/torrent application. Those IPs are other users trying to connect to the previous holder of that IP. It can take a while for those thing to time out and stop.
    Of course that only applies if you have a dynamic WAN type.

    Steve



  • @stephenw10:

    Probably your WAN connection has been given an IP that previously had been hosting some file sharing/torrent application. Those IPs are other users trying to connect to the previous holder of that IP. It can take a while for those thing to time out and stop.
    Of course that only applies if you have a dynamic WAN type.

    This. That's exactly what you'll get if you're assigned an IP that someone was running bittorrent on previously. If that IP hasn't been reassigned to you recently, then it's more likely something inside your network is running bittorrent causing it.



  • OK, thanks guys! There shouldn't be anything running it, so I guess I need to check some of my systems.

    Case Closed


Locked