explain this log entry?

[elmurado]

Hi could someone give me a quick rundown on reading this log entry?

Thur, 03/04/2004 00:07:22 - TCP connection dropped - Source:203..x.x.x, 4498, WAN - Destination:203..x.x.x, 135, WAN - 'Suspicious TCP Data'

Does this mean that my firewall found something sstrange, it came from (allegedly) 203.x.x.x
and it's source was my network 203.x.x.x. (destination IP =me?)
It was over the internet = WAN
and it was using UDP?
Now if I get heaps of these from the same IP then someone is trying harder than usual to find an open door?

[pooh sun tzu]

Thur, 03/04/2004 00:07:22 - Occured: thursday, March, 04, 2004 at 7am and 22 minutes

TCP connection dropped - Meaning: a connection was lost suddenly(correct me if I am wrong anyone)

Source:203..x.x. - The TCP connection drop came from the IP 203.x.x.x from their port 4498.

WAN - Destination:203..x.x.x, 135 - The Source IP (See above) tried to connect to the destination IP: 203.x.x.x on port 135 on your WAN IP (internet IP)

WAN - 'Suspicious TCP Data' Sounds like the application that made the log file recognizes this as not something that happens normally, and needs your attention.


It was using the TCP protocol. You know this because of the "TCP connection dropped" and the "Suspiscous TCP data". Also, port 135 is not a trojan port but a critical windows port. I'll snag some information on port 135 in a moment.

1. Were both IP's the same?
2. Are you on a home network?

[elmurado]

thanks.
I did mean TCP not UDP--I've been looking at these logs all day and my eyes are skware.
The Ip's were different..ie the source and the destination. Destination is my network...not ahome one which gets assigned ip every time we logon via adsl.
135 is RPC port and lots of things can use it DHCP/WINS etc.

[Tiger Shark]

Looks like it might be a scanning tool looking for an open RPC port. If it doesn't receive an appropriate answer, (SYN/ACK), then it probably sends a FIN or and RST so as not to appear to be a "Stealth" or Half Open Scan. That would be the "dropped" part. Your firewall may see it as suspicious, (which it is), simply because things were just out of order, (SYN- "nothing" - RST or FIN).

I don't think it's anything you should lose sleep over.

[elmurado]

thanks tiger...