> Are you sure this is in fact the one connection you are closing? I don't see what else it could be, certainly nothing legitimate. The only access to the box was me testing xrdp, running a tail -f alongside.
> Is the system connected to the internet (and reachable from there on the RDP > port)? Yes, it's connected to the internet, no it's not reachable from outside the LAN (on any port). > Removing the security tag as I do not see how IP based connections from > somewhere to your host could be a security bug in xrdp. Well, either xrdp is "phoning home" (worrying, but unlikely) or the displayed IP address is bogus (parsing error, an off pointer ...) -- both are potentially security relevant. Cheers, C.
