Lots of IPs conencted to me.. what the?

Discussion in 'other security issues & news' started by Nookie, May 9, 2005.

Thread Status:
Not open for further replies.
  1. Nookie

    Nookie Registered Member

    Joined:
    May 5, 2005
    Posts:
    20
    Location:
    Kent, UK
    Just checking out CommView to capture some packets and I've just noticed a large amount of connections on port 6346. From what I know the Gnutella network uses that port. I do have Bearshare & Emule installed but their never running and neither are running now. At present the only things accessing my network is this browser, AVG & my WLAN.

    What's going on? I've used Port Explorer to check out things as well but it isn't telling me anyone is conencted to me on that port.

    Look at this: http://xs28.xs.to/pics/05191/sniff.jpg
     
    Last edited: May 9, 2005
  2. Nick_morris

    Nick_morris Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    23
    Location:
    Ivybridge
  3. Nookie

    Nookie Registered Member

    Joined:
    May 5, 2005
    Posts:
    20
    Location:
    Kent, UK
    Huha thanks Nick. I just reset my router and now no more IPs :).
     
  4. Primrose

    Primrose Registered Member

    Joined:
    Sep 21, 2002
    Posts:
    2,743
    Q: What is a host cache? A: A host cache is a program which hands out IP addresses to gnutella clients. When a gnutella client is started it needs to find some other gnutella clients in order to connect to the network. The host cache provides those IP's. The hostcache is usually the first place you connect to when launching BearShare. Once you have received some addresses from the host cache then you attempt to connect to those addresses. The only reason to communicate with the host cache after that would be if all the IP addresses you had were not working and you needed some more IP addresses to try


    You really have 2 options.


    1- if that port is not opened on your machine and is being dropped, then you can create a rule on your firewall to reject attempts to that port. Instead of silently discarding them (drop). Maybe the master list will get the hint and remove your address. Keep your IP address for now and treat the attempts as frivolous port scans. They are not getting in anyways.


    2- If it really bothers you this much. Disconnect from the net and then reconnect, which should result in a new IP.


    Unless you start seeing massive connection attempts at the rate of several hundred min/sec. Then i would not concern myself too much with it. These are some of the headaches that you have to deal with when you get your IP changes often.


    Think of it as receiving mail (physical) to the person that used to live in your house.
     
  5. Nookie

    Nookie Registered Member

    Joined:
    May 5, 2005
    Posts:
    20
    Location:
    Kent, UK
    Thanks for that, I disconnected my router and reconnected so got a new IP :(.
     
  6. richrf

    richrf Registered Member

    Joined:
    Dec 11, 2003
    Posts:
    1,907
    Nookie,

    I am sure you will love your new IP as much as your old. :D

    Rich
     
Loading...
Thread Status:
Not open for further replies.