June 23rd, 2013, 10:30 PM
Am I getting attacked on port 3389?
Thanks in advance for helping me out.
I was hoping someone could take a look at the attached screenshot. It appears someone or something from China, Iceland, and other outside country IPs are trying to connect on port 3389. I know port 3389 is used for RDP and I can tell you there is no need for this service on this particular network. The foreign IPs and RDP leads me to believe something malicious is being attempted. Is the firewall doing it's job? Should I be worried? Should I simply block every foreign IP I see?
What has me confused is:
- Port 3389 should be closed, but it's still being attacked?
- The device ending in .115 is an android device and has since been removed from the network. Why would an andriod device be targeted?
- What exactly does "SYN_SENT" mean? Should I only be worried is a connected gets "ESTABLISHED"?
THANK YOU for the help. I've been stressing all week!
June 24th, 2013, 12:40 PM
Ya... Established would be a bad thing... Odds are that if you look in Event Viewer you'll see that the "attempt" to log in failed.
There's nothing you can do to avoid attempts to connect. Hackers write programs to automatically call out to random IP address and attempt to connect to machines. The programs do nothing but try and connect 24/7/365.
June 24th, 2013, 07:17 PM
Got a router?
They help stop stuff like that if set up properly.
By sdr8 in forum Site Feedback/Questions/Suggestions
Last Post: January 31st, 2003, 11:32 PM