Repeated requests at port 10169

I have been hanging around antionline for a while trying to learn a little about computer security and how to apply it to my own box but I am new to this, so please bear with me

My ISP using rotating IPs and I have been monitoring the requests the receive in my ZoneAlarm log. Usually they appear to be more or less random background noise or requests associated with P2P programs but occassionally I will receive repeated access attemps from the same source or from a few different sources on the same port, even though the port doesn't seem to be associated with anything in particular. Here is the latest :

Source :67.163.93.18:xxxx hsd1.il.comcast.net (Australia)
TCP protocol
Destination : port 10169 (shows up as unassociated in Shield's Up)

I receive upwards of one attempt every minute.

I have been playing with Ethereal but am lead to believe that it can't sniff packets outside a firewall and I am reluctant to disable it to see what this might be.

My question is : what is this intruder up to ? What was the last person with this IP up to ? How can I find these things out ?

DSL line, Win Xp, Zone Alarm

Thanks

Some basic googling shows that no-one else (at least with a high google page ranking) has much clue what that port is commonly used for either...so it's probably NOT commonly used for much. (P.S. good basic reference for TCP/UDP port numbers/application reference http://www.iana.org/assignments/port-numbers )

I know that there was a version of Ethereal released by Check Point that was supposed to work through their Secure Client host-firewall; of course it didn't work for me, YMMV.

I would suggest using a Live CD to boot the computer and run Ethereal from there, if you're concerned about connecting your PC without a local firewall.

You could also go do some research on different host firewalls and Ethereal, and see if one of them will work but allow ethereal to catch all traffic; I doubt it, but it's entirely possible. I think a Live CD (google for Knoppix or Live CD) is your best bet.

Not sure what that port was used for. Not sure why someone would even scan for that.
Ist that the only port they were probing?

A quick look over at incidents.org doen'st show much activity...
Well... thats compared to something like bittorrent or 139

Port 10169
http://isc.sans.org/port_details.php...ays=70&Redraw=
Port 6881
http://isc.sans.org/port_details.php...ays=70&Redraw=
Port 139
http://isc.sans.org/port_details.php...ays=70&Redraw=

However, you will notice that the source and destination reports for 10169 are pretty equal.

In the process of downloading Knoppix.

Yes, that is the only port. Also receiving hits at the same port from 141.158.167.37 cap.east.verizon.net (Virginia), less frequently though.

IPs seem to hang around for a few days on my ISP so hopefully I can work my way through Knoppix tomorrow http://images.antionline.com/images/smilies/frown.gif
frown.

Any suggestions for getting a quick connection to the internet for a first time user of Knoppix appreciated.

I'm curious about a few things here.

1) where did you get the IP info from ( Australia and Virginia )
What about N.J. and Pa. ??

2) What programs are running when this happens?

3) More important, what ports are open? ( you know you could try something like FPort to see what ports are being used )

Just because the firewall is blocking the incoming port doesn't mean it is closed. It only appears closed from the outside looking in.

1. The IP info came from AntiOnline IP finder.

2. Nothing out of the oridinary running (as per Hijack This). The only thing changed is my IP.

3. Fport shows nothing running on that port.

If nothing is running on that port then set the router to forward it to your internal address, fire up Ethereal and make yourself a capture. No harm can come becasue the port is closed.

Tiger, (s)he doesn't seem to have a router, its a Zonealarm FW. And I think they concerne with bringing down ZA is not specifically with this probe, but the general nastiness one is exposed to when surfing 'naked'.

Haha, a new phrase! "Surf Naked", I like it!

That's what happens when you post at 5:37am..... :o

ZoneAlarm still lets you open the port though doesn't it?

Not a clue. Personally (and no offense hesperus), I think it's pretty delinquent to use only a host based firewall, and I've not been a user of Zone Alarm for over 3-4 years, so I don't know what it is capable of. I would *THINK* it is pretty robust, seeing as how Check Point recently bought them and are integrating a lot of their soutions with ZA.

But you know what happens when we start thinking...similar to what happens when we ASSUME something.

Zone a'lama comes in VERY handy when traveling with a laptop. Who know what lurks in yonder airports. ;)

Quote:

---

1. The IP info came from AntiOnline IP finder.

---

as others, no comment on this :)

Quote:

---

2. Nothing out of the oridinary running (as per Hijack This).

---

But the question asked, what programs are running when this happens?

What I am getting at here with this question is were you running something during, or just prior to these entries? Could you have been running some type of game or other that you shut down just prior?

It is an unusual port. What protocol ( type of packet : ZA tells you that ) ?

It is TCP protocol, as I said earlier.

I really don't think it is related to any program I am running. The hits started as soon as I logged on with this particular IP and now have stopped since I have been assigned a new one. I used Fport as you suggested and it shows nothing at that port. The only things I had running were my mail program (uses different ports), AVG, ZA, and thats about it.

I am not sure if I can open a specific port in ZA but it does allow me to designate a certain incoming IP as friendly, which would in effect open the port it knocks at, I assume. I was tempted to do this for just a minute with Ethereal running but I don't know enough about what might be on the other side or what harm it might cause. I probably should have just done it but thought I might regret it. Thus I asked the question here. Better than asking how to clean up a screwed up system, I thought : )

Zencoder, no offense taken. As I said, I am new to this and still figuring things out. I keep everything updated and check for malware and viruses regularly. So far no major problems. Can you tell me a bit more about why I should be using a router ?

As I said, my IP has changed today and so far no hits at that port. I have burned Knoppix as suggested. I will experiment a little and be ready for next time.

Thanks all for the help. (Its 'he', by the way)

Quote:

---

It is TCP protocol, as I said earlier.

---

I was interested in the flags, but that's ok

Quote:

---

The hits started as soon as I logged on with this particular IP and now have stopped since I have been assigned a new one

---

Then it sounds like the computer that had that dynamic addy before you may have been running something on that port, old connections trying to reconnect to it.

It said 'flag:S'.

What you say is what I assumed but I was interested in the odd port number. I am not concerned about it, only wanted to figure out as much as I can so I can understand how things work. Every other hit I looked into was explicable. Thanks to the suggestions given I think I can sniff the packet a couple of differnet ways if it happens again.

Have got Knoppix running and will look into a router.

Just trying to learn.

PS.

My family owns garage and I know how little most know about the vehicles that are so central to their lives. So it is with computers. If you don't have some understanding of those little squeeks and rattles, even though they may be insignificant, your general ignorance is likely to leave you stranded when you least want to be. I give my automotive advice on other forum sites and I am happy to be able to glean some computer advice here.

Quote:

---

which would in effect open the port it knocks at

---

No... It won't.... Please make sure you understand this. It will allow packets sent to that port to reach the port - which is closed. That is significantly different from "opening" the port which means that a service is listening and will respond to a SYN packet with a SYN/ACK. As it is the SYN will reach the port which will respond with an RST packet as it is supposed to.... This will however allow the WinPcap driver to see the packet and log it. However, since this is a simple SYN packet there will most probably be nothing much to be learned from it unless it carries data, which it isn't _supposed_ to. There are however some sneaky forms of malware that only require the data encapsulated in a SYN packet to activate and target them..... In this case I doubt it is anything more than a basic SYN packet trying to contact a "service" it thinks is still at your address.