<![CDATA[Legitimate attack or a bot? what is this?]]>**I've seen a few blocks here and there but never this many for this long on the same ports from different addresses.

looking just fine on cpu/memory still but what is this attempting to do? lots more where this came from… From Russia with love I guess. ???**

]]>https://forum.netgate.com/topic/94568/legitimate-attack-or-a-bot-what-is-thisRSS for NodeTue, 13 Oct 2026 18:54:26 GMTSat, 23 Jan 2016 18:57:00 GMT60<![CDATA[Reply to Legitimate attack or a bot? what is this? on Tue, 26 Jan 2016 18:23:11 GMT]]>I've seen some clients that allow you to set the data ports, but the control ports are always random and no way to control that. Torrent has a lot of different ports.

]]>https://forum.netgate.com/post/598715https://forum.netgate.com/post/598715Tue, 26 Jan 2016 18:23:11 GMT<![CDATA[Reply to Legitimate attack or a bot? what is this? on Mon, 25 Jan 2016 15:09:04 GMT]]>^ agreed… this looks like p2p traffic..  Random ports to your same odd ball "random" high udp port.

Might not even have been you, if your IP changed and now your seeing traffic to someone else port that was member of swarm.  This sort of traffic can go on for days if not weeks..

There is really so much udp noise, that I turned off the block default logging on wan and put in a rule that logs blocks that are tcp syn only..  Makes the logs much easier to read ;)

]]>https://forum.netgate.com/post/598475https://forum.netgate.com/post/598475Mon, 25 Jan 2016 15:09:04 GMT<![CDATA[Reply to Legitimate attack or a bot? what is this? on Mon, 25 Jan 2016 14:30:05 GMT]]>I thought it looked like a swarm.  I believe that this is normal if you disconnect but you still have a ton of external clients trying to contact you.  Perhaps your torrent client is using random ports instead of the one you defined?

]]>https://forum.netgate.com/post/598472https://forum.netgate.com/post/598472Mon, 25 Jan 2016 14:30:05 GMT<![CDATA[Reply to Legitimate attack or a bot? what is this? on Sun, 24 Jan 2016 05:44:59 GMT]]>@KOM:

Are you running a torrent client, or were you?

yes. on port 51413

]]>https://forum.netgate.com/post/598292https://forum.netgate.com/post/598292Sun, 24 Jan 2016 05:44:59 GMT<![CDATA[Reply to Legitimate attack or a bot? what is this? on Sun, 24 Jan 2016 02:49:54 GMT]]>Are you running a torrent client, or were you?

]]>https://forum.netgate.com/post/598285https://forum.netgate.com/post/598285Sun, 24 Jan 2016 02:49:54 GMT<![CDATA[Reply to Legitimate attack or a bot? what is this? on Sat, 23 Jan 2016 19:04:38 GMT]]>The way i see it, unless there is infiltration, or flooding, one can drive themselves to banging the head trying to find out they why and who.

]]>https://forum.netgate.com/post/598230https://forum.netgate.com/post/598230Sat, 23 Jan 2016 19:04:38 GMT