Weird UDP scan entries in Comodo log

Discussion in 'other firewalls' started by mvdu, Jan 9, 2007.

Thread Status:
Not open for further replies.
  1. mvdu

    mvdu Registered Member

    Joined:
    Oct 14, 2003
    Posts:
    1,166
    Location:
    PA
    Hi, all,

    I noticed that Comodo has been reporting these UDP port scans, and lately I've noticed that I seem to get them when listening to music at MySpace. Seems to be any music. I have a router, and the weird thing is that it lists my router's address as the source. Here are a couple of the entries:

    Date/Time :2007-01-09 17:35:17
    Severity :High
    Reporter :Network Monitor
    Description: UDP Port Scan
    Attacker: 192.168.1.1
    Ports: 18448, 6416, 7440, 7696, 6672, 6928, 8208, 7952, 9744, 10256, 10000, 10512, 12560, 12816, 13328, 13584, 13840, 14096, 14608, 14864, 15120, 16144, 17168, 16400, 18192, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
    The attacker has been temporarily blocked

    Date/Time :2007-01-09 14:22:37
    Severity :High
    Reporter :Network Monitor
    Description: UDP Port Scan
    Attacker: 192.168.1.1
    Ports: 51208, 37384, 38664, 37896, 39176, 39432, 40200, 40712, 41480, 42248, 42504, 42760, 43528, 43784, 44808, 45064, 45576, 46600, 45832, 46088, 47112, 47880, 49160, 49928, 50952, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
    The attacker has been temporarily blocked

    What could be causing this, I wonder? No other firewalls show this.
     
  2. aagfr

    aagfr Registered Member

    Joined:
    Apr 15, 2004
    Posts:
    56
    I'm getting similar alerts; except that the address is my DNS server (I'm also behind a router):

    Date/Time :2007-01-09 08:46:33
    Severity :High
    Reporter :Network Monitor
    Description: UDP Port Scan
    Attacker: 68.87.76.178
    Ports: 30477, 22797, 23053, 23309, 23565, 23821, 24077, 24333, 24845, 25357, 25613, 25869, 26125, 26381, 26637, 26893, 27149, 27405, 27917, 28685, 28941, 29197, 29453, 29965, 30221, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
    The attacker has been temporarily blocked

    Date/Time :2007-01-09 08:40:43
    Severity :High
    Reporter :Network Monitor
    Description: UDP Port Scan
    Attacker: 68.87.76.178
    Ports: 36106, 28170, 28426, 28682, 28938, 29194, 29450, 29706, 29962, 30218, 30474, 30730, 30986, 31242, 31498, 32010, 32778, 33290, 33546, 33802, 34058, 34314, 34570, 34826, 35338, 21350, 15607, 22662, 4229, 22662, 2181, 2560, 0, 0, 26624, 21072, 26757, 21072, 133, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
    The attacker has been temporarily blocked
     
  3. mvdu

    mvdu Registered Member

    Joined:
    Oct 14, 2003
    Posts:
    1,166
    Location:
    PA
    Glad it's not only me. Maybe someone can explain it.
     
  4. mvdu

    mvdu Registered Member

    Joined:
    Oct 14, 2003
    Posts:
    1,166
    Location:
    PA
    So, is this anything to be concerned about? I'm thinking not since they are not reported by other firewalls, but I want to be sure.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.