My firewall has logged about a hundred hits to 15024 and 53 starting around 2300 est, all from various hosts. What gives?
Printable View
My firewall has logged about a hundred hits to 15024 and 53 starting around 2300 est, all from various hosts. What gives?
I was able to find this. It looks like an exploit designed to take advantage of vulnerabilities in BIND, BSD, and GNU versions of the DNS resolver. Just make sure that these are not normal DNS queries.
I was unfortunately not able to find any references to port 15024.
My suggestion would be to update your OS with the latest patch available.
What OS are you running?
Just keep your firewall running
DShield (http://www.dshield.org) reports lots of hits on 15024 on 9/11/03, not too much since.
I'm running Mac OSX with strict ipfw rules and blackhole enabled. I didn't consider the traffic a threat, I was more interested in what it could be.
UDP port 53 is for DNS, as for the 15024, most likely its an attempt for a game connection, found out that some games uses that particular port....
Also you might want to check out This
Quote:
This should be the end of the thread unless you are interested in those ports.
:p
BTW the guy has only just joined AO!!!!!!!!! Dont' neg him out yet!
Do not scare good or potentially good ppl. away!
Jezuz give the new members a chance!
Have a fu(*ing heart!
After all AO exixsts on ppl!
The responses here haven't been off-putting, they've been helpful. My hope was that someone would recognize the activity.Quote:
Originally posted here by Galdron
This should be the end of the thread unless you are interested in those ports.
BTW the guy has only just joined AO!!!!!!!!! Dont' neg him out yet!
Answered my own question:Quote:
Originally posted here by rib0flavin
My firewall has logged about a hundred hits to 15024 and 53 starting around 2300 est, all from various hosts. What gives?
Today I noticed another string of access attempts to (this time) udp port 11608 and 53. Then it occurred to me that I must be receiving packets meant for the previous owner of my dynamic IP. I confirmed in the firewall log that all the hits started after my modem had reconnected. ::hide-beh