Results 1 to 6 of 6

Thread: Multiple connection attempts blocked by external Firewall to TCP port 36863

  1. #1
    riceorony Guest

    Default Multiple connection attempts blocked by external Firewall to TCP port 36863

    Any one have a clue what that port is for?

    With this current IP address, I have consistent connection attempts from many different IP addresses (ranging from europe to south america) to TCP port 36863.

    This is seen when inspecting the external FWall log.

    I thought maybe this is due to one specific home computer calling out or something, but it happens no matter which computer is connected to the network.

    Any need for concern?

  2. #2
    prof_fate Guest

    Default Re: Multiple connection attempts blocked by external Firewall to TCP port 36863

    I did a GOGGLE.COM
    Search of that Port Address and got this..
    There is a problem with this website's security certificate.
    <div class="divider">The security certificate presented by this website was issued for a different website's address.Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.
    We recommend that you close this webpage and do not continue to this website.

    <div class="infoBlock">
    [*]If you arrived at this page by clicking a link, check the website address in the address bar to be sure that it is the address you were expecting.[*]When going to a website with an address such as https://example.com, try adding the 'www' to the address, https://www.example.com.[*]If you choose to ignore this error and continue, do not enter private information into the website.



    For more information, see &quot;Certificate Errors&quot; in Internet Explorer Help.<ul>[/list][/list]

  3. #3
    riceorony Guest

    Default Re: Multiple connection attempts blocked by external Firewall to TCP port 36863

    I'm assuming you were trying to connect to

    https://isc.incidents.org/port.html?port=36863

    right?

    there shouldn't be an &quot;https&quot; in that link, only http

    e.g. http://isc.incidents.org/port.html?port=36863
    or http://isc.sans.org/port.html?port=36863

    I dont know why http://isc.incidents.org (also now known as http://isc.sans.org and http://incidents.org) changed their URL, but oh well.

    I dont know why the page offers SSL encryption (https://isc.sans.org), when it doesnt work on the other pages (https://isc.incidents.org), I'm assuming because the SSL certificate applies to sans.org, and not to incidents.org (the old URL they used before 2004).

    Message Edited by riceorony on 12-23-2008 01:24 PM

  4. #4
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: Multiple connection attempts blocked by external Firewall to TCP port 36863

    Actually the secure https is correct.
    The link is https://isc.incidents.org/port.html?port=36863 but the server certificates are not correct - accept the server certificate and the site works okay.<hr>

    Not really a problem with the inbound attempts, anyways as this is getting blocked by the firewall.

    You could enforce this by blocking the TCP port range of 5001-65535 for both the outgoing and incoming in the Expert of the Firewall (assuming you do not play games or do any P2P or IRC which often require TCP ports over 5000).

    If you use a router, do the same with the router - block/close ports over 5000 up to 65535, but just for TCP (UDP range of ports for the dns servers range from low to high, so leave the UDP alone.


    Usually .ve, .br, co and a few other south/central american are famous for hackers/malware sites and spammers.
    You may want to look at the IANA IPv4 address space list to block off the LACNIC (latin america and caribean registries) and maybe the AFRNIC (lower and middle Africa registries and regions close to that) and APNIC (asia and pacific registries).
    You may want to enter these IP ranges in the blocked zone of the zonealarm firewall - this way these usually unwanted sites are blocked off permanently (plus the many bad sites associated with this global regions).


    Oldsod.
    Best regards.
    oldsod

  5. #5
    riceorony Guest

    Default Re: Multiple connection attempts blocked by external Firewall to TCP port 36863

    Oldsod,

    I have done as you recommended, Thank You.

    Have a Merry Christmas and a Happy New Year my friend!

    Best regards,
    riceorony

    Message Edited by riceorony on 12-24-2008 06:00 PM

  6. #6
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: Multiple connection attempts blocked by external Firewall to TCP port 36863

    You too have a Merry Christmas and a Happy New Year, my friend.

    Best regards, Richard.
    Best regards.
    oldsod

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •