Port 13139

I was just going throug my routers incoming access list and noticed a whole bunch of different IP's attempting to access port 13139. Theres probably about 50 of these right in a row, but from about 12 different IP's. Of course my routers been dropping these incoming IP's, but its kinda got me curious.

Has anyone else been receiving anything like this.
Maybe its some script kiddie checking to see if I have a trojan.

One more thing.

I usually recieve no alerts from my firewall since I'm behind a router, but the past couple hours I keep getting port scanned. I didn't think you could really do it since I'm on a lan and my router is the one exposed to the net. I've gone to websites where they portscan me but my firewall doesn't bring up any warnings, because they're portscanning my router, but how is it that my actual computer is being scanned from outside my lan? When I check my logs it says that at least 11 ports have been scanned.

Isn't that a game port for Medal of Honor?

http://www.pure-mohaa.co.uk/forum/th...id=315&posts=3

Quote:

---

afaik fallout (http://www.interplay.com/falloutbos/) uses this port.


and the snort.org - port database reports
>>Port 13139 / udp
Keyword gamespy arcade ping

---

looks like its a game port ...

Ahhh. That explains it.

I've been playing Battlefield 1942 a lot and I go through gamespy to connect. Thank you for clearing that up.

Now for my second question.

How is it that my computer is being portscanned when I'm behind a router?
I didn't think you could do it.

When you say your behind a router, do you mean your PC is assigned
an RFC1918 address(private address) and your router is performing
a PAT(port address translation). Because it matters alot...

If you are not using an RFC 1918, you can be behind 100 routers, and you'll still be scanned..

However if you are using private IP, I agree wth you .THAT IS PRETTY STRANGE...

forgot to add something else, if your connection is a wireless one, someone
might have compromised your network using tools such as netstumbler(wardriving)

I don't know a whole lot about my router, but it is a nat router. My router has a IP of 66.xxx.xx.xxx. and my pc is 192.168.1.100. The thing is, when I go to websites to scan myself, it says that they can't scan me because it seems I'm behind a router which I am.

My connection is via landline. DSL. So I'm not a victim of wardriving.

If your router is doing NAT versus PAT you can also be port scanned.
The difference is this:

With NAT (network address translation) your router is doing a one to one
static translation versus a dynamic one. What that means is any scans, requests, etc to your public 66.x.x.x address will automatically be forwarded to your PC. The router has no way
to know a scan from a hack or just a innocent request to what may be your web server on inside (this is ofcourse assuming your router is not set up with some filtering)

Basically with NAT, the router does a static one to one translation which means connections
CAN BE INITIATED FROM THE OUTSIDE (which also means no one else on your inside LAN other
than one and only one PC can share that 66.x.x.x public address.

PAT on the other hand occurs ONLY when connections are initiated from the inside. Dynamically the router will do a translation along with a random port number to the 66.x.x.x address. This has the advantage of many PCs on inside to share the public address.

The only draw back to PAT is that connections cannot be initiated from the outside.
(which is what you want for security purposes unless you require connections be initiated from outside to your LAN)

Also, once a session is over, PAT terminated the translation..That is why if your router is doing a PAT, there is NO way anyone can scan your 192.168.x.x address. This is an RFC address and is not routable on all BGP4 Internet routers.....

Hope this helps

P.S.
The fact that you couldn't scan yourself from a web site validates that most likely your router is doing a PAT which makes it very strange that your recieving those alarms...Are there any other devices/pcs on the same LAN? I would put a protocol analyzer if you could on iside and outside of your DSL router and do a capture for more detailed analysis..

From what you said there, it sounds like my router is PAT. Mainly because I am sharing one internet connectin with up to three computers(big network huh?) Also No matter what kind of scans I do my self against my network, I cannot see any of my computers only the public IP address which is assigned to my router.

I have network monitor inside my lan monitoring my connections, but when you say on the outside of my DSL router what do you mean?

Thanks for your help.

I thought maybe you had what Telco calls a DSL modem (which is really a bridge) connected to a router that you may have purchased.. I thought your setup was similiar to following:

Pcs--------------||||Router||--------------|||DSL-Modem|||-------------Internet

and what I meant was putting a sniffer between the router and DSL modem...

Also hust out of curiosity, when your firewall was reporting port scans, did it specify the source IP..Was it a public or private address...

The port scan came from a public IP address.

My network IP begins with 192.x.x.x. The IP from which I was scanned was 207.x.x.x.

As far as my setup you pretty much have it right. The only things connected to my DSL modem is the phone line and a Cat 5 cabel running to my wan port on the router.

Can you recommend any good sniffers?

tcpdump is a good one. Ethereal is another good one. :)

Have you considered a NIDS like snort?

I've thougt about it before but have never really had the time. I think that I'm gonna go ahead and download it today though.

Thanks for all the help.

If you need help with snort there are lots of users around here that have used it. I believe that there is a short tut in one of the AO newsletters and somewhere in the tutorials as well. Also, they have extensive documentation on installing snort on your flavour of OS. :)

I recently upgraded my NIDS from Snort 2.0 to 2.0.1. But haven't turned it back on due to the blackout issues.

I finally got my linux system running, so I fired up nmap and scanned the IP address thats been scanning me.

I used the -sS and -O options.

Heres what nmap found

Quote:

---

Starting nmap 3.30 ( http://www.insecure.org/nmap/ ) at 2003-08-16 22:03 BST
Interesting ports on dns-lax.centurytel.net (207.xxx.xxx.xxx):
(The 1627 ports scanned but not shown below are in state: closed)
Port State Service
7/tcp open echo
9/tcp open discard
13/tcp open daytime
19/tcp open chargen
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
37/tcp open time
53/tcp open domain
79/tcp open finger
100/tcp open newacct
512/tcp open exec
513/tcp open login
514/tcp open shell
515/tcp open printer
540/tcp open uucp
7100/tcp open font-service
Device type: general purpose
Running: Sun Solaris 8
OS details: Sun Solaris 8 early access beta through actual release
Uptime 79.257 days (since Thu May 29 15:54:47 2003)

Nmap run completed -- 1 IP address (1 host up) scanned in 48.810 seconds

---

After a whois search with sam spade it seems that this is my ISP. But I'm still confused as to how they are portscanning me.

I also did a portscan of my public IP. Heres the results from that

Quote:

---

Starting nmap 3.30 ( http://www.insecure.org/nmap/ ) at 2003-08-16 21:50 BST
Interesting ports on pppoe-209-xxx-xxx-xxx.rb.spt.centurytel.net (209.xxx.xxx.xxx):
(The 1642 ports scanned but not shown below are in state: closed)
Port State Service
80/tcp open http
113/tcp filtered auth
Device type: broadband router|WAP
Running: Cnet embedded, Linksys embedded
OS details: Cnet CNIG904B Internet Broadband Gateway firmware version 1.11, Linksys BEFW11S4 WAP or BEFSR41 router

Nmap run completed -- 1 IP address (1 host up) scanned in 14.091 seconds

---

I'm not to experienced with this part yet, so can anyone see anything strange from nmap scanning my Public IP or does it look ok?

Cheyenne, I forgot to mention earlier, your router may be performing a PAT as well as a NAT.
Some routers support this feature. The way this works is the 1st PC on inside LAN gets
statically NATTED and every subsequent PC will get PATTED with same public address
along with a random port number .

This will explain how it is possible of being scanned even though you have a private Ip address. Because your public address is always statically one-to-one natted to your private
address (the 1st PC that goes out).

Now Im not sure how or what you did when you yourself attempted to scan yourself from the outside and was unable to..

I suggest just for shits and giggles to have someone (afriend whom you trust) to scan your router to verify for sure...Im very curious to know results...

If you dont have a friend whom you trust,,,then you have a bigger problem,,,lol,,just kidding.
You can try and sign up for any free dial up ISPs and test...

As far as protocol analyzers. See the thread on sniffers for windows that is currently posted,,,
Alot available out there..Ethereal, analogx, etc....

My guess is that your router is performing a PAT as well as NAT and if you attempt to scan your rotuer again, you will find that you are able to..

Good Luck...

Heres what a friend found using Lan Guard Scanner

NETBIOS discovery ...
Done sending, waiting for responses ...
SNMP discovery ...
Community string : public
Done sending, waiting for responses ...
ICMP sweep ... (PING!)
Done sending, waiting for responses ...
Ready
No computers found.
Ready


Heres what I found using Net Brute scanner on a dial up connection

209.xxx.xxx.xxx # 25
209.xxx.xxx.xxx # 80
209.xxx.xxx.xxx # 81
209.xxx.xxx.xxx # 82
209.xxx.xxx.xxx # 83
209.xxx.xxx.xxx # 110
209.xxx.xxx.xxx # 119

However, when I used another scanner it showed no ports for my connection.

If you really want to put an end to this, turn on a "server" on your PC that was scanned.
Do it temporarely and turn of personal firewall on PC.

This could be http/80, telnet/23 or ftp/21 . Then try to connect from outside again as you did before with your friend but to one of the above applications...

If you connect, then you're router is definitely natting...

ex. if your public address is the 66.x.x.x and you have port 21 turned on your pc. FTP to 66.x.x.x from outside and see if you connect. Verify that you ftp to your PC and not your router..

P.S.
Your router could also be "buggy" which explains why sometimes you are able to scan and other times you are not..Very possible especially if your router is one of the off the beat shelf
appliance routers (Linksys, etc...)

You may want to entertain investing in a cisco 2501 serries router from ebay for about
$100-150 . It will server you 2 purposes, one you have a stable IOS and two you will be on your way learning how to configure a real router that is used in professional industry to help your career in IT industry....

I might try that cisco router.

Thanks for the help.

THis thread has interested me, as I have had some similar happenings on my home network. In my Snort logs it will show a port scan, from a public IP, to my private IP 192.168.0.1. I have also noticed that some ICMP messages get to my computer as well. If somebody were to source route a scan would they be able to get traffic to my LAN?