cancel
Showing results for 
Search instead for 
Did you mean: 

What's hammering on my firewall (and seemingly getting through)?

SimonN
Dabbler
Posts: 14
Thanks: 2
Registered: ‎26-05-2017

What's hammering on my firewall (and seemingly getting through)?

Split this from a thread in the Fibre section as I found it whilst trying to track down a (seemingly unrelated) line fault. My firewall is being hit multiple times per second with traffic from a range of IPs all of which seems to be being sent to 192.168.1.67 on port 60951. I don't understand (a) what the hell is all this traffic? Just random probes? (b) why does it appear to be being let through the firewall? The machine on that private IP is my main computer (macOS) but it's not running any services that use that port AFAIK and the traffic continues even when the machine is off. I turned off UPnP and removed all my port forwarding and it's still continuing. 

 

My router log is attached

3 REPLIES 3
Jaggies
Aspiring Pro
Posts: 1,700
Thanks: 34
Fixes: 2
Registered: ‎29-06-2010

Re: What's hammering on my firewall (and seemingly getting through)?

Do you have a static IP? If you don't, what it looks like is bit-torrent clients searching for someone who previously had your IP address and was file sharing. It should just peter out eventually.

The firewall is doing it's job, so probably not anything to be concerned about.

Actually, scrub that. The firewall appears to be letting the probes through, but as there (probably) isn't a bit-torrent client running, they don't appear to be a threat.

Scrub again - that IP address is a Plusnet one. https://mxtoolbox.com/SuperTool.aspx?action=ptr%3a209.93.9.229&run=toolpage

That doesn't make the first part of the post irrelevant, however...

 

SimonN
Dabbler
Posts: 14
Thanks: 2
Registered: ‎26-05-2017

Re: What's hammering on my firewall (and seemingly getting through)?

Thanks, it was actually me using bit torrent so share files as part of an event. I didn't realise it would keep attracting traffic afterwards so there's probably nothing noteworthy there.

 

When you say the firewall is doing its job. Wouldn't you expect traffic on a closed port to be blocked? I don't really know much about firewalls but I thought without UPnP or port forwarding traffic would be stopped?

Jaggies
Aspiring Pro
Posts: 1,700
Thanks: 34
Fixes: 2
Registered: ‎29-06-2010

Re: What's hammering on my firewall (and seemingly getting through)?

That's why I scored out that line...
If you don't have a static IP, you can change your IP address just by disconnecting your Internet connection via the router interface. Leave it off for 10-15 minutes, then reconnect, and you should get a new IP address, and (hopefully) no more probes.