Network router question, part deux

[tomdkat]

So, in this thread I described an interesting situation where some "random" machine was able to attempt a connection to a Windows XP Home Edition (SP3) system on UDP port 1026 which is behind a Belkin Wireless G router. The router doesn't have any DMZs configured and no port forwarding is configured.

Today, another machine with an IP from china (202.97.238.235) tried to connect to the above system on UDP port 1026. Once again, ZoneAlarm blocked the connection attempt. There is nothing running on the system which is listening on port 1026 and chat software isn't used on this machine.

I'm going to do a firmware upgrade on the router now. If another connection is blocked by ZoneAlarm again, I'm swapping out the router.

The firewall in the router IS enabled and the firewall log shows some DoS blocks from a handful of unique IPs, one of which is interestingly ONE address away from the IP assigned to the router.

That's the latest.

Peace...

 

[Couriant]

are you allowing data on that port in your router's settings?

 

[tomdkat]

Not explicitly. There is no port forwarding or in-bound routing configured in the router at all.

Peace...

 

[Couriant]

can you set a deny filter for that port?

 

[tomdkat]

I don't know. I'll have to see the next time I'm at my mom's house.

Peace...