Connection Requests

I have noticed, while using outpost firewall that under attack detection my computer gets alot of connection requests. Usualy one about every 2 minutes rangin from many different ip address. Usualy I'll get along streak from the same IP address and then it changes to something else.

Now what I want to know is what this may be? Also I will give you the specific ports they are trying to access. They try to access a wide range of ports also. Most are in the mid 1000's, but here are the most recent ones.

tcp(1938)
tcp(1859)
tcp(1433)
tcp(2036)
tcp(2040)
tcp(2056)
icmp(2048)
udp(5882)
tcp(6346)

now this is all from the last two hours or so and I still have about 100 more listed. But they are mostly repeating ports. They are all asking for connection requests. I also noticed the other day getting a ping request from the same ip address that was also asking for a connection request. And the other night I received two nuke attacks.

first off can someone explain to be the difference between the TCP,ICMP,UDP? Second explain to me one reason I may be receiving these attacks(if thats what they truely are). Third explain to me what type of ports these general are.

Thank's

-Data

ports 0 - 1023 are well known ports which has specific services running like ftp which runs on port 21, port 23 for telnet etc..

ports 1024 - 49151 are registered ports (the ports you mentioned comes in this) these ports are used by browsers, ftp softwares who open random ports within these to communicate. So there is nothing for you to worry.

ports 49152 -65535 are private ports which are used by trojans.. if you find any of these ports open,you need to do something.

TCP (transmission control protocol) It is the reliable transport protocol in the tcp/ip suite. Reliable means it recovers from lost data

UDP (user datagram protocol) It is unreliable protocol as it does not maintain any provision for recovery of data loss in transmission. But its faster and mainly used in video transmissions where some data loss doesnt do any harm

ICMP- Internet cntrol message protocol - It is used to replay network conditions, different errors to ip and other layers.

Hope that clears all your doubts.

to your first question try this adress:
http://www.cisco.com/univercd/cc/td/...ito_doc/ip.htm
this is a detailed description of network protocols
to your second question:
if there are so many connection requests on different ports it could be an attack, but why you are attacked you have to ask yourself...
to your third question:
this is a very long port list there you should find every port and the name of the app using it
http://www.iana.org/assignments/port-numbers
if you like some more information i would try at google e.x. tcp(1938)

------------------------------------------------------------------------------------------------------------------------
"Knowledge is the Real Power"