Perhaps there is a scan to 123.123.1.2 using your firewall's address as source address So you have the reply (with source = 137 = dest port of the scan and dest port increment).
Or it's a scan to your firewall using a fixed source port to have it look like a worm. Is 123.123.1.2 an internal host ?? If it comes from the inside, watch if the MAC address fits the internal gateway's MAC address and try to debug the traffic from the internal gateway. Regards Nicolas figaro -----Original Message----- From: Nick Brandson [mailto:[EMAIL PROTECTED] Sent: Tuesday, February 17, 2004 8:19 AM To: [EMAIL PROTECTED] Subject: [FW-1] Suspicious Traffic in the Log Dear guru, Found some strange thing logged in the log viewer... Source from 123.123.1.2 to MyFirewallInternalIP with source port 137, dest port 830, 831, 832.... 859... for every two minutes. Is it normal or we have infected by worm? thanks Nick __________________________________ Do you Yahoo!? Yahoo! Finance: Get your refund fast by filing online. http://taxes.yahoo.com/filing.html ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
