Internet attacks!?

[dmor]

Hello everyone. I have recently had reason to be concerned about my internet security (Sister in-law is staying with us to get away from husband, he somehow got my wifes new email address that she had not even used yet) and checked my firewall log. I am getting denied attempts at a rate of at least one per minute for the past several days. There appears to maybe a dozen at most different ip address'. Is this something I should be concerned about or is this normal activity? Thanks for any help.

 

[wightstraker]

.I am getting denied attempts at a rate of at least one per minute for the past several days.

It's unlikely to be an actual attack if they're coming that quickly and persistently. Are you using a DHCP/NAT router? I know mine has caused some screwy log messages in the past.

Also, are you using iChat? Sometimes it gets chatty with DHCP routers as well.

 

[dmor]

Hi, thanks for the reply. My wife and son might use ichat but it's not running now. I restarted to make sure no chat programs were running and they are still coming fast and furious. No to the router.

 

[StevyWhy]

I happened to notice the following in my system.log (viewed via System Profiler) today, and it's been going on all day long:

Dec 20 15:25:12 (Name of computer) kernel[0]: Stealth Mode connection attempt to UDP 192.168.2.2:137 from 192.168.2.1:15664
Dec 20 15:25:16 (Name of computer) kernel[0]: Stealth Mode connection attempt to UDP 192.168.2.2:137 from 192.168.2.1:15664
Dec 20 15:25:19 (Name of computer) kernel[0]: Stealth Mode connection attempt to UDP 192.168.2.2:137 from 192.168.2.1:15664

I substituted "(Name of computer)" above for the actual name of my Mac. My wired ethernet router assigns my Mac the address of 192.168.2.2. The router itself has the address 192.168.2.1. So it looks like something is attempting to access UDP port 137 on my Mac.

Does anyone know what port 137 is for? And what's a Stealth Mode Connection? Is my router and it's firewall creating this activity, or is someone out there trying to get at my computer? Any info would be appreciated.

 

[Eidorian]

Hello everyone. I have recently had reason to be concerned about my internet security (Sister in-law is staying with us to get away from husband, he somehow got my wifes new email address that she had not even used yet) and checked my firewall log. I am getting denied attempts at a rate of at least one per minute for the past several days. There appears to maybe a dozen at most different ip address'. Is this something I should be concerned about or is this normal activity? Thanks for any help.

It's more then likely Internet Background Radiation.

I happened to notice the following in my system.log (viewed via System Profiler) today, and it's been going on all day long:

Dec 20 15:25:12 (Name of computer) kernel[0]: Stealth Mode connection attempt to UDP 192.168.2.2:137 from 192.168.2.1:15664
Dec 20 15:25:16 (Name of computer) kernel[0]: Stealth Mode connection attempt to UDP 192.168.2.2:137 from 192.168.2.1:15664
Dec 20 15:25:19 (Name of computer) kernel[0]: Stealth Mode connection attempt to UDP 192.168.2.2:137 from 192.168.2.1:15664

I substituted "(Name of computer)" above for the actual name of my Mac. My wired ethernet router assigns my Mac the address of 192.168.2.2. The router itself has the address 192.168.2.1. So it looks like something is attempting to access UDP port 137 on my Mac.

Does anyone know what port 137 is for? And what's a Stealth Mode Connection? Is my router and it's firewall creating this activity, or is someone out there trying to get at my computer? Any info would be appreciated.

http://www.grc.com/port_137.htm

The Google's first hit to "port 137".

 

[yellow]

With that address, it's another computer on your private subnet, meaning, another computer attached to your wireless router/router. And that port means that there's a PC being shared, or trying to share to your Mac. Windows file sharing is REALLY chatty. So, that is nothing to be worried about in particular.