Weird UDP scan entries in Comodo log

Discussion in 'other firewalls' started by mvdu, Jan 9, 2007.

Thread Status:
Not open for further replies.
  1. mvdu

    mvdu Registered Member

    Joined:
    Oct 14, 2003
    Posts:
    1,151
    Location:
    PA
    Hi, all,

    I noticed that Comodo has been reporting these UDP port scans, and lately I've noticed that I seem to get them when listening to music at MySpace. Seems to be any music. I have a router, and the weird thing is that it lists my router's address as the source. Here are a couple of the entries:

    Date/Time :2007-01-09 17:35:17
    Severity :High
    Reporter :Network Monitor
    Description: UDP Port Scan
    Attacker: 192.168.1.1
    Ports: 18448, 6416, 7440, 7696, 6672, 6928, 8208, 7952, 9744, 10256, 10000, 10512, 12560, 12816, 13328, 13584, 13840, 14096, 14608, 14864, 15120, 16144, 17168, 16400, 18192, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
    The attacker has been temporarily blocked

    Date/Time :2007-01-09 14:22:37
    Severity :High
    Reporter :Network Monitor
    Description: UDP Port Scan
    Attacker: 192.168.1.1
    Ports: 51208, 37384, 38664, 37896, 39176, 39432, 40200, 40712, 41480, 42248, 42504, 42760, 43528, 43784, 44808, 45064, 45576, 46600, 45832, 46088, 47112, 47880, 49160, 49928, 50952, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
    The attacker has been temporarily blocked

    What could be causing this, I wonder? No other firewalls show this.
     
  2. aagfr

    aagfr Registered Member

    Joined:
    Apr 15, 2004
    Posts:
    56
    I'm getting similar alerts; except that the address is my DNS server (I'm also behind a router):

    Date/Time :2007-01-09 08:46:33
    Severity :High
    Reporter :Network Monitor
    Description: UDP Port Scan
    Attacker: 68.87.76.178
    Ports: 30477, 22797, 23053, 23309, 23565, 23821, 24077, 24333, 24845, 25357, 25613, 25869, 26125, 26381, 26637, 26893, 27149, 27405, 27917, 28685, 28941, 29197, 29453, 29965, 30221, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
    The attacker has been temporarily blocked

    Date/Time :2007-01-09 08:40:43
    Severity :High
    Reporter :Network Monitor
    Description: UDP Port Scan
    Attacker: 68.87.76.178
    Ports: 36106, 28170, 28426, 28682, 28938, 29194, 29450, 29706, 29962, 30218, 30474, 30730, 30986, 31242, 31498, 32010, 32778, 33290, 33546, 33802, 34058, 34314, 34570, 34826, 35338, 21350, 15607, 22662, 4229, 22662, 2181, 2560, 0, 0, 26624, 21072, 26757, 21072, 133, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
    The attacker has been temporarily blocked
     
  3. mvdu

    mvdu Registered Member

    Joined:
    Oct 14, 2003
    Posts:
    1,151
    Location:
    PA
    Glad it's not only me. Maybe someone can explain it.
     
  4. mvdu

    mvdu Registered Member

    Joined:
    Oct 14, 2003
    Posts:
    1,151
    Location:
    PA
    So, is this anything to be concerned about? I'm thinking not since they are not reported by other firewalls, but I want to be sure.
     
Loading...
Thread Status:
Not open for further replies.