Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Blasted by multiple src IPs' to dst UDP port 25073

    Scheduled Pinned Locked Moved Firewalling
    7 Posts 3 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      BxuEyE4
      last edited by

      anyone else getting hit by multiple src's to dst port 25073?

      i can't find much info about that port. it may be nothing but then again thought i'd ask.

      if this isn't a correct forum to ask such, is there a reputable forum you folks use to post such questions?

      tia

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        blasted means what - couple of hits? The net is full of noise dude ;)

        Your ip change to one that was running P2P on that port?  Where you running p2p on that port and now you removed your forward?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • B
          BxuEyE4
          last edited by

          @johnpoz:

          blasted means what - couple of hits? The net is full of noise dude ;)

          Your ip change to one that was running P2P on that port?  Where you running p2p on that port and now you removed your forward?

          i understand about the internet noise. and "blasted" in this case means daily & constantly. like random src's to that specific port. i just don't recall seeing that in my logs until recently. this is a home system(s) so its not like systems are  checked religiously everyday.

          i don't have port forwarding on this pfsense fw. i used to on the previous ipcop fw. pretty much a default install.

          scanning my fw from grc.com returned port 25073 isn't open.

          its a good call regarding p2p though i haven't used any such app in months. now that you brought it up, i will check some of my systems here to see if i have something other running i've forgotten about. entirely possible.

          appreciate your reply

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            You can see traffic to the port you were on for quite some time after leaving a swarm.  Months seem a bit long, but for days after you leave a swarm for sure is common if not a couple of weeks.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • P
              phil.davis
              last edited by

              and if you have a dynamic IP, then the IP you currently have may have been allocated to someone else in the recent past who offered some P2P thing that happened to be on that port number. Dumb clients all over the place might still be trying to send or get data at that IP:port combination.
              That sort of thing could really eat up your download quota - and it is not even your fault!

              As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
              If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

              1 Reply Last reply Reply Quote 0
              • B
                BxuEyE4
                last edited by

                appreciate the help and ideas. i checked my VM's and disconnected devices.  the attempts still occur, though that might be lingering.

                regardless, i put in a ticket to cable provider to check.

                may be nothing, but that many hits for that particular port from so many "diff" IP's is worth investigating.

                thanks for all the help and ideas.

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  "i put in a ticket to cable provider to check."

                  What are they going to check - you still never mentioned what a blast is - is it 10 hits an hour, 100, 1000 a minute?

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.