HELP: What does this log mean?

[P4spooky]

Hi All:

I am a newbie to networking. I have a TOSHIBA cable modem hooked to a Dlink DI-707 Router/Switch. Everything works fine. This switch has a firewall built in and I was looking at the log below.

----- Start Log -----
Saturday, November 30, 2002 1:27:03 AM Unrecognized access from 12.212.233.156:3795 to TCP port 80
Saturday, November 30, 2002 1:27:06 AM Unrecognized access from 12.212.233.156:3795 to TCP port 80
Saturday, November 30, 2002 2:30:39 AM Unrecognized access from 12.212.233.156:4761 to TCP port 80
Saturday, November 30, 2002 8:06:14 AM Unrecognized access from 12.212.35.250:1680 to UDP port 1680
Saturday, November 30, 2002 9:29:37 AM Unrecognized access from 81.48.113.63:4390 to TCP port 21
Saturday, November 30, 2002 9:29:40 AM Unrecognized access from 81.48.113.63:4390 to TCP port 21
----- End log -----

Question: Is my firewall doing its job?

 

[minendo]

Do you have any ports open?

The last two connections were attempting to gain access through the standard FTP port. Port 80 is your Internet port and I have no idea what port 1680 is.

 

[P4spooky]

minendo:

WOW thanks for the quick response. AS you know this is a 7 port switch. I have a structured panel in my house and both the modem and the router are inside the panel. I have ethernet ports all over the house. All seven ports in the router are connected inside the structured panel. I have two computers in my office plugged to the wall (ethernet port) and one laptop in the bedroom. All of them are always on.

I did not mess with any settings in the router, just turned on and started using. As far as I can tell, DHCP is enabled and each of my computer have a unique IP address and is different from the IP that is assigned by AT&T. Does this make sense?

Thanks, Sri

 

[bsobel]

----- Start Log -----
Saturday, November 30, 2002 1:27:03 AM Unrecognized access from 12.212.233.156:3795 to TCP port 80
Saturday, November 30, 2002 1:27:06 AM Unrecognized access from 12.212.233.156:3795 to TCP port 80
Saturday, November 30, 2002 2:30:39 AM Unrecognized access from 12.212.233.156:4761 to TCP port 80
Saturday, November 30, 2002 8:06:14 AM Unrecognized access from 12.212.35.250:1680 to UDP port 1680
Saturday, November 30, 2002 9:29:37 AM Unrecognized access from 81.48.113.63:4390 to TCP port 21
Saturday, November 30, 2002 9:29:40 AM Unrecognized access from 81.48.113.63:4390 to TCP port 21
----- End log -----
Question: Is my firewall doing its job?

[/quote]

Yes, you'll say many random attempts to probe you daily, welcome to life on the internet

Bill

 

[igiveup]

Port 1680:

microcom-sbp 1680/tcp microcom-sbp
microcom-sbp 1680/udp microcom-sbp
# Boris B. Maiden <Boris_Maiden@smtp.microcom.com>

IANA.org TCP & UDP port listing link

Thank god for google...

I don't know about your router but if you want it to not respond to pings on your ports then my linksys router guide said to put static routes for these well known ports to point to an IP address on your network that will NEVER be utilized and thereby have no response to the pings. Thats only if your router doesn't have a setting to deny respond to pinging, like mine. Basically just set the ip address and port for something thats outside of your DHCP scope to be safe.

 

[bsobel]

microcom-sbp 1680/tcp microcom-sbp
microcom-sbp 1680/udp microcom-sbp

Sure thats the iana registration, but I'll bet you thats not the service the probe was looking for
Bill