constant probes on port 25975

Archived from groups: comp.security.firewalls (More info?)

We're seeing probes inbound on port 25975 every couple seconds from a
specific Ip, while I've already contacted rogers abuse and they are
giving the owner 2 days, I would like to know what they are trying to
connect to on our end. I can't find anything that uses port 25975.

2005/08/28 00:00:17.43 I tcp 24.101.232.187
cpe000d88b065e4-cm400049342774.cpe.net.cable.rogers.com
64263 XX.YY.ZZZ.AA 25975

Any ideas?

--

spam999free@rrohio.com
remove 999 in order to email me

Archived from groups: comp.security.firewalls (More info?)

On Mon, 29 Aug 2005 10:15:38 GMT, Leythos wrote:

> We're seeing probes inbound on port 25975 every couple seconds from a
> specific Ip, while I've already contacted rogers abuse and they are
> giving the owner 2 days, I would like to know what they are trying to
> connect to on our end. I can't find anything that uses port 25975.
>
> 2005/08/28 00:00:17.43 I tcp 24.101.232.187
> cpe000d88b065e4-cm400049342774.cpe.net.cable.rogers.com
> 64263 XX.YY.ZZZ.AA 25975
>
> Any ideas?

BitTorrent? Some other P2P application? I know that BitTornado, a client
that I use, will randomly pick any port from 10000 to 60000 with UPnP
enabled to control ports on the router. Many users of P2P clients set them
to use high ports to avoid their ISPs blocking on the default client ports.

--
Norman
~Shine, bright morning light,
~now in the air the spring is coming.
~Sweet, blowing wind,
~singing down the hills and valleys.

Archived from groups: comp.security.firewalls (More info?)

I understand the UDP is a broadcast protocol and just comes down the pipe
for anything that is listening.

Thanks for the other info. I guess I'll just let the FW block it on its own.

I do have another question about my ISP's DNS servers sending unsolicited
inbound on UDP port 53 to the external IP at the same high port number
35469, which the FW is blocking this traffic. Do you know what that is
about? I don't think I have noticed this traffic until I started using
static IP(s) on one of my machines recently.

Duane