What's hammering on my firewall (and seemingly getting through)?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Plusnet Community
- :
- Forum
- :
- Help with my Plusnet services
- :
- My Router
- :
- Re: What's hammering on my firewall (and seemingly...
What's hammering on my firewall (and seemingly getting through)?
29-05-2017 10:12 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
Split this from a thread in the Fibre section as I found it whilst trying to track down a (seemingly unrelated) line fault. My firewall is being hit multiple times per second with traffic from a range of IPs all of which seems to be being sent to 192.168.1.67 on port 60951. I don't understand (a) what the hell is all this traffic? Just random probes? (b) why does it appear to be being let through the firewall? The machine on that private IP is my main computer (macOS) but it's not running any services that use that port AFAIK and the traffic continues even when the machine is off. I turned off UPnP and removed all my port forwarding and it's still continuing.
My router log is attached
Re: What's hammering on my firewall (and seemingly getting through)?
29-05-2017 10:19 PM - edited 29-05-2017 10:26 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
Do you have a static IP? If you don't, what it looks like is bit-torrent clients searching for someone who previously had your IP address and was file sharing. It should just peter out eventually.
The firewall is doing it's job, so probably not anything to be concerned about.
Actually, scrub that. The firewall appears to be letting the probes through, but as there (probably) isn't a bit-torrent client running, they don't appear to be a threat.
Scrub again - that IP address is a Plusnet one. https://mxtoolbox.com/SuperTool.aspx?action=ptr%3a209.93.9.229&run=toolpage
That doesn't make the first part of the post irrelevant, however...
Re: What's hammering on my firewall (and seemingly getting through)?
29-05-2017 10:32 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
Thanks, it was actually me using bit torrent so share files as part of an event. I didn't realise it would keep attracting traffic afterwards so there's probably nothing noteworthy there.
When you say the firewall is doing its job. Wouldn't you expect traffic on a closed port to be blocked? I don't really know much about firewalls but I thought without UPnP or port forwarding traffic would be stopped?
Re: What's hammering on my firewall (and seemingly getting through)?
30-05-2017 7:09 PM
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Highlight
- Report to Moderator
If you don't have a static IP, you can change your IP address just by disconnecting your Internet connection via the router interface. Leave it off for 10-15 minutes, then reconnect, and you should get a new IP address, and (hopefully) no more probes.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Plusnet Community
- :
- Forum
- :
- Help with my Plusnet services
- :
- My Router
- :
- Re: What's hammering on my firewall (and seemingly...