Incoming activity on port 10811

Elanadine · 11-27-2005, 01:18 PM

Recently I've been having problems connecting. I hadn't yet set up my router for port blocking, but on checking the logs I noticed a lot of both ingoing and outgoing activity on ports 1024 - 1030. I set my router to block all ports from 1000 - 65535. I had to reconnect to my cable hook up, but I eventually was able to do that. Today I decided to check the logs. The outgoing connections all seem ok, but there are several incoming connections on port 10811 and a handful on ports 1026 and 1027. The IP addresses are fairly consistent. If needed, I'll be happy to provide those addresses.

Is this something to be concerned about, or is there a simple explanation?

OS-Windows XP Pro; Red Hat 9 (dual boot)
Router - (wired)Linksys BEFSR41 ver 2

**johnwill** · 11-27-2005, 02:32 PM

It would have been real helpful to see the IP addresses and the associated port connections.

Elanadine · 11-27-2005, 06:21 PM

Here are some of the IP addresses and the ports used (almost all are port number 10811 so I haven't shown that one, just the ports that are different than that):

85.178.60.78
70.246.60.63
69.231.82.72
65.184.156.78
66.191.240.34
172.178.158.183
68.108.250.143
200.221.63.11
61.138.136.28 used twice - port 1026 and 1027
81.191.6.63
69.179.1.75
67.164.34.200 port 80?
206.54.113.228 port 1027
206.56.94.4 port 1026
221.10.158.140 twice - port 1027 and 1026
201.1.71.253

I haven't checked all the IP addresses, but found some originate from ripe.net and others from lacnic.net. The port 80 one is probably legit.

**johnwill** · 11-27-2005, 06:45 PM

Well, they come from all over the globe, I think I'd be doing malware scans and posting a HijackThis log at this point.

Elanadine · 11-27-2005, 07:03 PM

Nothing's showed up in a malware scan, but I'll try HJT.

11-27-2005, 01:18 PM	#1 (permalink)
Elanadine Registered User Join Date: Nov 2005 Location: Pacific Northwest Posts: 3 OS: XP and Red Hat 9 (I have a dual boot)	Incoming activity on port 10811 Recently I've been having problems connecting. I hadn't yet set up my router for port blocking, but on checking the logs I noticed a lot of both ingoing and outgoing activity on ports 1024 - 1030. I set my router to block all ports from 1000 - 65535. I had to reconnect to my cable hook up, but I eventually was able to do that. Today I decided to check the logs. The outgoing connections all seem ok, but there are several incoming connections on port 10811 and a handful on ports 1026 and 1027. The IP addresses are fairly consistent. If needed, I'll be happy to provide those addresses. Is this something to be concerned about, or is there a simple explanation? OS-Windows XP Pro; Red Hat 9 (dual boot) Router - (wired)Linksys BEFSR41 ver 2

11-27-2005, 02:32 PM	#2 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,832 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	It would have been real helpful to see the IP addresses and the associated port connections. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

11-27-2005, 06:21 PM	#3 (permalink)
Elanadine Registered User Join Date: Nov 2005 Location: Pacific Northwest Posts: 3 OS: XP and Red Hat 9 (I have a dual boot)	IP addresses and corresponding ports Here are some of the IP addresses and the ports used (almost all are port number 10811 so I haven't shown that one, just the ports that are different than that): 85.178.60.78 70.246.60.63 69.231.82.72 65.184.156.78 66.191.240.34 172.178.158.183 68.108.250.143 200.221.63.11 61.138.136.28 used twice - port 1026 and 1027 81.191.6.63 69.179.1.75 67.164.34.200 port 80? 206.54.113.228 port 1027 206.56.94.4 port 1026 221.10.158.140 twice - port 1027 and 1026 201.1.71.253 I haven't checked all the IP addresses, but found some originate from ripe.net and others from lacnic.net. The port 80 one is probably legit.

11-27-2005, 06:45 PM	#4 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,832 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Well, they come from all over the globe, I think I'd be doing malware scans and posting a HijackThis log at this point. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

11-27-2005, 07:03 PM	#5 (permalink)
Elanadine Registered User Join Date: Nov 2005 Location: Pacific Northwest Posts: 3 OS: XP and Red Hat 9 (I have a dual boot)	Nothing's showed up in a malware scan, but I'll try HJT.