ISP talking to port 53?

I have noticed since I changed ISP that my routers WAN light goes crazy and does not stop. A few times my personal firewall alerted me to an incomeing conection from my isp to port 53. I know from google this port has to do with the DNS, possibly my routers DNS. Heck I dont even know if my router has its own DNS service but maybe I should check. Anyway does anyone know what reason an ISP would be conecting to its customers?

I have the DLINK DI-524 Rev A if that makes any difernce but on google I read about others haveing this problem with various Routers/ISP and the only explanations I can find are worm trafic which Im sure my ISP would not be infected with a worm.

also is there a way to view a log for all router trafic, not just the ids log. Router still blinking like crazy even after I deny the incomeing 53 connections.

Anyone have some ideas on this.

Quote:

---

Originally posted here by sposes
...and the only explanations I can find are worm trafic which Im sure my ISP would not be infected with a worm.

also is there a way to view a log for all router trafic, not just the ids log. Router still blinking like crazy even after I deny the incomeing 53 connections.

Anyone have some ideas on this.

---

If there is any way to view logging for all traffic through this "router" it would be listed somewhere around here.

Port 53 connections or traffic may (doubtful, but MAY) be made as responses to your own port 53 queries outwards.

Also, I am certainly sure your ISP *would* be infected with a worm. The problem with the statement there is "infected". I don't think your ISP is infected per se...but it is very possibly passing worm traffic to you, since they probably don't block traffic that "might" be from a worm, only traffic that is "certainly" from a worm (and not even that, perhaps.)

Basically, the general advice would be "get over it". The background traffic of worms, viruses, and port scan's throughout the internet these days is not to be worried over. Just as soon should you worry about airliners passing overhead, dropping chunks of 'blueice' on your head to do you in. *shrug*

Hope that helps.

Thanks, ok so I can now understand that it can be normal to expect incomeing port 53 trafic, so Ill ignore it as sugested, however what about my routers wan light blinking non stop, when I am not downloading anything and the computer/s are off. Have you heard of this kinda thing, since I suspect its some kinda comunication from my isp but is driveing me nuts.

I had viewed dlinks suport many times but unfortunately it seems the only log I can view is the built in ids and only shows me droped packets and detected atacks, I was hopeing there was a third party software that can alow me to see the trafic, since Ive tryed sniffers before and they only seem to pick up on the trafic that goes in and out of my computer, but not the trafic that is soley handled by my router.

but it may *not* be normal to be recieving traffic on this port.

If you suspect that it is some kinda communication from your ISP, make a rule for your firewall (software) to block both TCP 53 and UDP 53 both incoming/outgoing for all hosts. if it is your ISP connection (which I doubt), you will not be able to use the net. if so you can simply delete the rule unblocking the ports. if you can still connect, keep them blocked. this is basic trial and error and you don't have to worry about locking yourself out of the internet (simply un-do the firewall rule if you need to).

also about the packet sniffer. you aren't getting much out of it likely because your router is blocking the ports you want to see. you can fix this by forwarding those ports in your router to your current private IP address (would be a 192.168 address). you can find your current private IP address by going to Start > Settings > Control Panel > Network and choose your current NIC card out of the list and click "Properties". there will be an "IP Address" tab, click it. the number filled in there is your current IP address, and that is the address that you want to forward ports to (NOT your router's IP address). this will open up traffic for the specific ports.

forward TCP port 53 and UDP port 53 to your private IP address. then start up the packet sniffer and you will be able to see exactly what is going on on those ports. but make sure your software firewall still isn't blocking those ports (that is if you set it to) as if so you still won't be seeing traffic coming though those ports (same deal as your router blocking them).


Peace.

Quote:

---

to block both TCP 53 and UDP 53 both incoming/outgoing for all hosts

---

This is bad advice. If you write a rule to block *all* TCP/UDP 53 traffic, you've just killed DNS for all of your internal hosts. I hope you like visiting sites by IP because if you do this, that's the only way you're getting to them.

You can get a packet dump and then decide if you want to block traffic from that *specific* host, not all hosts. Do you know what a normal DNS transaction looks like? If not, look at some samples.

To get you started, if you see TCP DNS queries, then this is indicative of a zone transfer between two name servers. If you see UDP DNS queries, this is indicative of normal name resolution requests generated by a host to a DNS server.

Whatever you decide to do, just understand the impact before going nuts with rules and such. A simple phone call to your ISP may be the quickest route to solving your mystery. Sometimes old technology works wonders. ;)

--TH13

sposes, I may not have been clear. I wasn't saying
"All Traffic Inbound To 53 *IS* acceptable..." sorry if you got that message. As th13 indicates this could be necessary.

It really depends on how your D-Link works for DNS with your LAN, and some other things.

The point I was mostly addressing was the WAN light. If you don't like it blinking all the time, there are two options...#1 tape-over/color-over/break the bulb so you can't see it blink, or #2 disconnect your D-Link from the internet.

There is absolutely nothing you can do if it is connected 'to the cloud' as we say. There *will* be stray packets hitting it, and some of them *will* be hostile, although probably blind (as in, not directed at you necessarily, but generally malicious and you had the fortune to recieve one.)

That's life on the internet. Nothing you can do about it, if you want to plug in to the rest of the world.

Quote:

---

Originally posted here by sposes
... however what about my routers wan light blinking non stop, when I am not downloading anything and the computer/s are off. Have you heard of this kinda thing, since I suspect its some kinda comunication from my isp but is driveing me nuts.

---

Even if you block the traffic on your router/firewall, your WAN activity light will still blink because the packets are still coming across the wire. If you see a lot of WAN activity AND a lot of LAN activity, then you have something to worry about because that means the packets are getting through. WAN activity is normal - you just don't want to see that traffic on the other side of the router/firewall.

Thanks to all, I will be doing some research into DNS as up till now ive only known two things about it, that it resolves domain names into ip and that it works on port 53. While reading on google yesterday I came across discussions of zone transfers and when I tryed to find out more info about it, I was unsuccessfull. If someone can point me to a site that explains zone transfers that would be greatly apreciated. Im gona try some of the sugestions and see what kind of info I can dig up.

Aditionaly, thanks thehorse13 for makeing the UDP 53 and TCP 53 clear, Now I have something to go on. Many thanks to everyone.

Quote:

---

Originally posted here by thehorse13
This is bad advice. If you write a rule to block *all* TCP/UDP 53 traffic, you've just killed DNS for all of your internal hosts. I hope you like visiting sites by IP because if you do this, that's the only way you're getting to them.

You can get a packet dump and then decide if you want to block traffic from that *specific* host, not all hosts. Do you know what a normal DNS transaction looks like? If not, look at some samples.

To get you started, if you see TCP DNS queries, then this is indicative of a zone transfer between two name servers. If you see UDP DNS queries, this is indicative of normal name resolution requests generated by a host to a DNS server.

Whatever you decide to do, just understand the impact before going nuts with rules and such. A simple phone call to your ISP may be the quickest route to solving your mystery. Sometimes old technology works wonders. ;)

--TH13

---

I think you misread my post.

Quote:

---

this is basic trial and error and you don't have to worry about locking yourself out of the internet (simply un-do the firewall rule if you need to).

---

this is what I would have done, found that I could no longer browse sites by hostname and un-done the rule. you will live a boring life if you are afraid to take small risks like this. instead of overwhelming someone with techie words, try a little trial and error. this is HOW you learn. if he had of done this he would have found that 53 is an essential port. so would have I. I would have un-done the rule and everything would have been fine and dandy again. if you are using a software firewall that will not let you undo custom rules you should start looking for an alternative IMO.


Peace.

Quote:

---

this is what I would have done, found that I could no longer browse sites by hostname and un-done the rule. you will live a boring life if you are afraid to take small risks like this. instead of overwhelming someone with techie words, try a little trial and error. this is HOW you learn. if he had of done this he would have found that 53 is an essential port. so would have I. I would have un-done the rule and everything would have been fine and dandy again. if you are using a software firewall that will not let you undo custom rules you should start looking for an alternative IMO.

---

Try using this argument when you drop the net connection for a multimillion dollar company


sorry, this is a stupid argument. there is no point in taking risks when the result is a guarantee. Its like saying "im going to try not breathing, becasue maybe this time I can live without oxygen, so what if millions have died from suffocation"

Quote:

---

some people dont learn, average people learn from their mistakes, wise people learn from the mistakes of others

---

I have since been researching dns to beter understand the comunications between my router and my isp. I also dont want this to become any sort of heated discussion, not to say that is what is hapening or not. I greatly apreciate all the advice and insight given and I will continue on my learning curve.

Quote:

---

I think you misread my post.

---

There is nothing to misread about this:

Quote:

---

If you suspect that it is some kinda communication from your ISP, make a rule for your firewall (software) to block both TCP 53 and UDP 53 both incoming/outgoing for all hosts.

---

This makes about as much sense as telling someone to take the tires off their car because it won’t start. However, according to someone with your logic this makes sense because you then tell the poor guy to do this right after you told him to block all:

Quote:

---

forward TCP port 53 and UDP port 53 to your private IP address. then start up the packet sniffer and you will be able to see exactly what is going on on those ports.

---

Quote:

---

this is what I would have done, found that I could no longer browse sites by hostname and un-done the rule.

---

If this is what you would have done then it’s painfully obvious that you have no understanding of the proper way to troubleshoot networking issues. The guy isn’t asking you to participate in a lab experiment; he needs help with his primary internet connection.

Quote:

---

you will live a boring life if you are afraid to take small risks like this.

---

Why don’t you live dangerously and take the risk with your own equipment instead of “learning” at the expense of others?

Quote:

---

instead of overwhelming someone with techie words, try a little trial and error. this is HOW you learn.

---

ROFLMFAO. Are you kidding me? Techie words? Information Technology, hmmmmm… How the hell do you expect to solve the problem unless you completely understand all the technical aspects involved? Also, thank you for explaining how to learn. What would I do without this profound enlightenment?

Quote:

---

if he had of done this he would have found that 53 is an essential port. so would have I. I would have un-done the rule and everything would have been fine and dandy again…

---

Why would you tell him to do things when you don’t understand the impact of the action? This is not only reckless, it’s a shitty thing to do to others.

Bottom line:

*You don’t understand networking.
*Not only do you have no business responding to this post, but as a member of this community, you have the responsibility to NOT make things worse by telling a person to try something out when you don’t understand the impact of the action. If you can’t help yourself and you must post, at least tell the guy that you have no idea what will happen. At least this way he can ignore you.
*Your argument only makes you look more retarded.
*You gave bad advice – period.

I’m done.

LMFAO
Almost as entertaining as today's Handler's Diary

Quote:

---

Needless to say, Mr. Vendor (and his boss) got a quick phone call from me, wherein I pointed out my belief that some village somewhere must be missing its idiot.
Don't follow in his footsteps. Your village needs you...

---

----------------------

Quote:

---

since I changed ISP that my routers WAN light goes crazy and does not stop.

---

You didn't say what type connection you had or have now. Guessing broadband.

With my broadband, my receive light on the cable modem does not stop blinking.
Just haven't gotten around to taping it over yet ;)

Not all the traffic coming into the modem is meant for me, but broadcasts, scans, normal traffic, etc. on the subnet I am on. And yes, some of the scans are directed at me, but my perimeter firewall blocks them. ( you have a perimeter firewall on that router? )

Quote:

---

A few times my personal firewall alerted me to an incomeing conection from my isp to port 53.

---

What firewall? You said personal firewall so it is not the one on the router, but on the client? ( inside the LAN ).
I've seen ZA do this, even though it was configured with the DNS server as trusted, ( go figure ); it was actually a response the client initiated.

Since you are doing research on this, maybe you could tell me this:
How is your ISP ( their DNS server ) sending your client machine these packets when it is behind a router if it was unsolicited? ( I'm assuming two things here, one that your client has a private IP address, and two that your are not using Ipv6. )

Problem was solved today around 3PM EST (GMT -05:00) when I phoned my previous ISP and asked them to reactivate my account which was on hold for 6 months while I try the new ISP.

The guess was corect about it being brodband, I should have stated in my post. Now back with previous ISP My WAN light is now constant unless Im useing the internet or some other activite is trying to get through, just the way I like it. Haveing a WAN light blinking 24/7 drives me nuts when Im trying to sleep.


As for those DNS connections, they semed to be legit DNS trafic but when I setup a sniffer finaly able to capture the mysterious activity it seemd to be comunications between my router and ISPSD cisco router, determined that by finding a ports list. The ports the high activity was ocureing on were used by cisco routers.

EDIT: It was the loss of connection 50 times in three weeks that made me terminate services with the ISP and go back to other. I wish we (Tonronto) had more then two internet providers, monopoly, well actualy there is four for my area but the other two have rahter expensive startups, but does seem cheaper in long run.