[cph54]

Hi;

I hope someone can help. I always keep an eye on my firewall traffic log, and over the past few weeks I have noticed a much higher amount of incoming traffic attempting to access my computer. About 90% of it comes from the same IP address (or similar range).

I know this is often caused by some infection/spyware, but I have run every scan in the book, and nothing comes up. Also, I am obsessively (!) careful about what I download.

Does anyone have any idea why I am getting all this traffic from one place? I appreciate your time. Thanks guys.

[wk2000]

Are you saying that the firewall is blocking a whole bunch of incomming traffic? What ports are they trying to access?

Just curious, are you talking about a hardware firewall or software one?

[Pettos]

Hey,

If your firewall is blocking the traffic, then you've really got nothing to worry about IMO. Also, if you've run virus scans and they have come clean.

As long as your firewall has blocked it, and continuing to block it, you'll be fine.

[cph54]

Hey;

Thanks for your replies. I have software firewall (McAfee). The traffic is mostly going to ports 1026-1028. It has increased significantly over the past couple of weeks. I guess I am just wondering if there is a particular reason why this may happen.

Thanks for your insights.

[wk2000]

I can't tell you why, but port 1028 seems popular lately, see:
http://isc.sans.org/port.html?port=1028