Blasted by multiple src IPs' to dst UDP port 25073
-
anyone else getting hit by multiple src's to dst port 25073?
i can't find much info about that port. it may be nothing but then again thought i'd ask.
if this isn't a correct forum to ask such, is there a reputable forum you folks use to post such questions?
tia
-
blasted means what - couple of hits? The net is full of noise dude ;)
Your ip change to one that was running P2P on that port? Where you running p2p on that port and now you removed your forward?
-
blasted means what - couple of hits? The net is full of noise dude ;)
Your ip change to one that was running P2P on that port? Where you running p2p on that port and now you removed your forward?
i understand about the internet noise. and "blasted" in this case means daily & constantly. like random src's to that specific port. i just don't recall seeing that in my logs until recently. this is a home system(s) so its not like systems are checked religiously everyday.
i don't have port forwarding on this pfsense fw. i used to on the previous ipcop fw. pretty much a default install.
scanning my fw from grc.com returned port 25073 isn't open.
its a good call regarding p2p though i haven't used any such app in months. now that you brought it up, i will check some of my systems here to see if i have something other running i've forgotten about. entirely possible.
appreciate your reply
-
You can see traffic to the port you were on for quite some time after leaving a swarm. Months seem a bit long, but for days after you leave a swarm for sure is common if not a couple of weeks.
-
and if you have a dynamic IP, then the IP you currently have may have been allocated to someone else in the recent past who offered some P2P thing that happened to be on that port number. Dumb clients all over the place might still be trying to send or get data at that IP:port combination.
That sort of thing could really eat up your download quota - and it is not even your fault!
-
appreciate the help and ideas. i checked my VM's and disconnected devices. the attempts still occur, though that might be lingering.
regardless, i put in a ticket to cable provider to check.
may be nothing, but that many hits for that particular port from so many "diff" IP's is worth investigating.
thanks for all the help and ideas.
-
"i put in a ticket to cable provider to check."
What are they going to check - you still never mentioned what a blast is - is it 10 hits an hour, 100, 1000 a minute?
