Is this an Attack on my Firewall ?

[Bruce L]

My firewall is reporting port access attempts like this one.

Jan 25, 2005 13:54:01.712 UTC - 70.248.157.157 : 26931 >>> 209.xx.xx.xx : 1026

ie attempts to access port 1026 which is listed as the calendar access protocol. Is this an attempted attack, a portscan or what ?

Thanks,

Bruce

 

[electron]

Is this TCP or UDP? Do you have any other log entries which contain that ip address (If you do, can you please paste them)? The port numbers in use are rather strange, so hopefully you have more. The IP belongs to SBC Internet Services, but I can't resolve the DNS, which is unusual for a broadband/dialup connection, so it could be a machine sitting on a T1 line or something. Even if it is an attack, you have nothing to worry since your firewall drops it, and it is probably an automated probe.

Btw, if the protocol is UDP, then I believe that's the port for Windows Messenger, so it's just a spammer, and you have nothing to worry about.

 

[Bruce L]

well my router does not provide protocol informations
But after further research i think it must be UDP 1026 so it is messenger spans.
Thanks for the tip.

Bruce