Results 1 to 6 of 6

Thread: Sequential port access attempts from router

Hybrid View

  1. #1
    thomasak9 Guest

    Default Sequential port access attempts from router

    I an using a dlink router to connect two computers to my cable modem. One computer is running ZA free and the other is running ZA Extreme. The computer running ZA Extreme seems to be under attack as there are attempts to access ports continually. Every 10 seconds there is around 20 attempts to access the ports by access attempts on sequential port numbers. The computer running ZA free has none of these alerts in the logs and seems to be fine.

    Here is an example of my current ZA extreme log -
    ACCESS,2010/08/13,06:01:12 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1984).,N/A,N/A
    ACCESS,2010/08/13,06:01:12 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1985).,N/A,N/A
    ACCESS,2010/08/13,06:01:12 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1986).,N/A,N/A
    ACCESS,2010/08/13,06:01:12 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1987).,N/A,N/A
    ACCESS,2010/08/13,06:01:12 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1988).,N/A,N/A
    ACCESS,2010/08/13,06:01:12 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1989).,N/A,N/A
    ACCESS,2010/08/13,06:01:30 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1994).,N/A,N/A
    ACCESS,2010/08/13,06:01:30 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1995).,N/A,N/A
    ACCESS,2010/08/13,06:01:30 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1996).,N/A,N/A
    ACCESS,2010/08/13,06:01:30 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1997).,N/A,N/A
    ACCESS,2010/08/13,06:01:30 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1998).,N/A,N/A
    ACCESS,2010/08/13,06:01:30 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 1999).,N/A,N/A
    ACCESS,2010/08/13,06:01:32 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 2001).,N/A,N/A
    ACCESS,2010/08/13,06:01:32 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 2002).,N/A,N/A
    ACCESS,2010/08/13,06:01:32 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 2003).,N/A,N/A
    ACCESS,2010/08/13,06:01:32 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 2004).,N/A,N/A
    ACCESS,2010/08/13,06:01:32 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 2005).,N/A,N/A
    ACCESS,2010/08/13,06:01:32 -8:00 GMT,Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (192.168.0.1:Port 2007).,N/A,N/A


    Can anyone tell me why this is happening?

  2. #2
    Join Date
    Dec 2002
    Location
    San Carlos, California
    Posts
    1,636

    Default Re: Sequential port access attempts from router

    Hello,

    Well the activity is from your own network and not the internet.

    The ip address being logged was issued by your routers NAT to a local device on your network and its not from the internet.


    Forum Moderator
    Click here for ZA Support
    Monday-Saturday__ 6am to 10pm Central time
    Closed Sundays and Holidays

  3. #3
    thomasak9 Guest

    Default Re: Sequential port access attempts from router

    thanks for the response.
    I am a little confused,
    If I understand correctly, the port access attempts are coming from the router and are being initiated by one of my two computers?
    So would that mean that one of the two is infected with a virus or trojan?
    I am new to networking, so forgive my ignorance.

    My router has always been password protected with a unique pasword, as has both computers and the Zone Alarm programs.

    This seems to have started about 2 weeks ago with the previous Microsoft Update prior to this weeks major security update.

  4. #4
    Join Date
    Nov 2004
    Location
    localhost
    Posts
    17,291

    Default Re: Sequential port access attempts from router

    Hi!

    the log seems to indicate that you have not trusted your LAN/router (set to internet instead of trusted) and then calls are rejected. Normally your LAN should be set to TRUSTED.

    If you do not want to set your LAN as trusted then add your DHCP and DNS to the firewall trusted zone. You will need to add also the IP of the PC(s) on your lan to share resources (printer, files, etc).

    To know your DNS and DHCP you will need to run the OS commond IPCONFIG /all

    Cheers,
    Fax

    Click here for ZA Support
    Monday-Saturday 6am to 10pm Central time
    Closed Sundays and Holidays

  5. #5
    thomasak9 Guest

    Default Re: Sequential port access attempts from router

    Thanks for the reply.
    You are correct, I have continued to set the router to "internet" whenever I restart my computer. I will see what happens when i set it to the "trusted" zone.

    The way the router seemed to be "Attacking" only one of the computers ports had me worried. I have run several scans in ZA and utilizing other programs such as MalwarBytes, Kaspersky, etc. and both computers scanned clean. That is why I was so worried, but I feel more secure now.



    Thanks very much for helping this networking rookie out....

  6. #6
    Join Date
    Nov 2004
    Location
    localhost
    Posts
    17,291

    Default Re: Sequential port access attempts from router

    You're welcome!

    Cheers,
    Fax

    Click here for ZA Support
    Monday-Saturday 6am to 10pm Central time
    Closed Sundays and Holidays

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Replies: 5
    Last Post: July 17th, 2010, 01:26 AM
  2. Many many attempts at the same port
    By pelicanstuff in forum Windows and ZoneAlarm Messages and Alerts
    Replies: 4
    Last Post: November 5th, 2007, 08:09 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •