Full Version: Need Help Random Ip's keep connecting to computer
Well, in peer guardian I used to get about 4 random connections a second. I mean random, like bbc news, newsentry, sony corporation, these were some of the big ones that were blocked, but usually their let through. Most of which are coming in from my torrent ports 32500 or 137(not torrent), and I don't have any torrents running. So first I thought, I got a lot of spyware, spyware scan nothing, avast antivirus, nothing. Still connections coming in, clean format, clean os install, no programs installed except peerguardian and protowall. About 2 a second which seems to give me the thought of an software problem. It's a brand new computer, and it's only coming in on this computer, none of the other computers on the network. Only about once a min are some blocked, the rest are all granted permission. I used to have a lot of icmp connections before the format, but now their mostly udp streams. This is driving me crazy, I'm about to request an ip change from my isp, it's unreal. If I portforward the torrent address to another internal address it shows up at peerguardian beeing forwarded to the specified port, but then I seem to get more of completely random ports coming in, like 1439, 1440, 1039. Is this normal I've never gotten this before. Maybe it's a virus, I formatted the drive before reinstalling, where could it have saved to. Anybody know what I should do? Should I check the network just in case? Thanks Jim
QUOTE (jimbob3000 @ Oct 15 2006, 03:43 AM) 
Well, in peer guardian I used to get about 4 random connections a second. I mean random, like bbc news, newsentry, sony corporation, these were some of the big ones that were blocked, but usually their let through. Most of which are coming in from my torrent ports 32500 or 137(not torrent), and I don't have any torrents running. So first I thought, I got a lot of spyware, spyware scan nothing, avast antivirus, nothing. Still connections coming in, clean format, clean os install, no programs installed except peerguardian and protowall. About 2 a second which seems to give me the thought of an software problem. It's a brand new computer, and it's only coming in on this computer, none of the other computers on the network. Only about once a min are some blocked, the rest are all granted permission. I used to have a lot of icmp connections before the format, but now their mostly udp streams. This is driving me crazy, I'm about to request an ip change from my isp, it's unreal. If I portforward the torrent address to another internal address it shows up at peerguardian beeing forwarded to the specified port, but then I seem to get more of completely random ports coming in, like 1439, 1440, 1039. Is this normal I've never gotten this before. Maybe it's a virus, I formatted the drive before reinstalling, where could it have saved to. Anybody know what I should do? Should I check the network just in case? Thanks Jim
Here's some examples:
http://www.filesend.net/download.php?f=764...0927135b85d4508 video of grants
http://www.filesend.net/download.php?f=e68...ecd5afacfc9fc25 blocked pic
Well, I messed around with it more, and removed all port forwarding, hard reset to defualt settings and it stopped. I only get normal traffic now. Just a quick question am I still getting monitored. Was I getting monitored, traceroute picks up only my isp, and where I'm going. Yeah? Really bad crap? Now when I put the torrents port back in, well, woah nothing. That was weird. Thanks anyways for whoever spent their time reading this.
Hi jimbob
Do you have a hardware firewall or just a router ? A lot of the UDP connections on your torrent port may be from having DHT enabled in your torrent client. The port 137 stuff is netbios traffic which can be covered by a hardware firewall if it's set up to block that traffic and do you have netbios disabled on your connection ?.
I've always recommended using a software firewall even if you have a router/hardware firewall , for one thing you can see what isn't being blocked and you can fine tune your hardware firewall if needed and it will also help take care of anything other traffic that you need to block that is being allowed by a simple IP blocker.
Do you have a hardware firewall or just a router ? A lot of the UDP connections on your torrent port may be from having DHT enabled in your torrent client. The port 137 stuff is netbios traffic which can be covered by a hardware firewall if it's set up to block that traffic and do you have netbios disabled on your connection ?.
I've always recommended using a software firewall even if you have a router/hardware firewall , for one thing you can see what isn't being blocked and you can fine tune your hardware firewall if needed and it will also help take care of anything other traffic that you need to block that is being allowed by a simple IP blocker.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.