6

I'm running Mac OS X and I have the system firewall enabled and I have stealth mode enabled. I opened up my system console and noticed that I'm getting tons of blocked connection attempts from places I'm not familiar with. I checked the locations of some of these addresses and some are from China and Japan. These are just a few of them, but I've got hundreds of attempted connections. I'm glad OS X is doing its job and blocking them, but is this something I should be worried about? Is this normal for a home user? What's on these ports anyways?

10/7/11 12:29:47.319 PM Firewall: Stealth Mode connection attempt to TCP 192.168.1.102:49710 from 84.40.104.29:16960

10/7/11 12:29:48.078 PM Firewall: Stealth Mode connection attempt to TCP 192.168.1.102:49706 from 142.151.157.96:14082

10/7/11 12:29:52.792 PM Firewall: Stealth Mode connection attempt to TCP 192.168.1.102:49703 from 150.101.189.21:64929

10/7/11 12:29:57.067 PM Firewall: Stealth Mode connection attempt to TCP 192.168.1.102:49730 from 180.213.74.14:6002

10/7/11 12:29:59.388 PM Firewall: Stealth Mode connection attempt to TCP 192.168.1.102:49741 from 124.121.40.124:10502

371273
  • 163
  • 1
  • 4
  • 4
    How exactly are these internet facing addresses finding their way directly to your Mac located on the 192.168.1.0\24 subnet? Are you routing internet packets directly into your internal network? With a good NAT-Firewall at your internet border, you should NEVER see these packets on your system. – MToecker Oct 07 '11 at 21:54

2 Answers2

5

Yes, it is normal background noise. Those addresses are most likely belonging to infected computers that are trying to infect more computers.

If you have too much time you can do a whois query (web frontend) and contact the service providers telling them about the infected machines.

But the best approach is to disable logging of rejected connection attempts and ignore them. They are just burying the important messages.

Hendrik Brummermann
  • 27,258
  • 6
  • 81
  • 121
4

I've found that googling the port numbers (e.g. a search for "tcp 49741") will often lead you to a reference that will tell you which trojans/backdoors listen on those ports. E.g. Port 49741 at SANS -- though it doesn't have any information for this particular port beyond recent scan frequency.

The last time I checked my internet-facing firewall logs, there were tons of these kind of connection attempts. These are probably automated scans coming from bots that are scanning for vulnerable machines to take over. These are constant noise.

The connection attempts you have to worry about are those that aren't being stopped by your firewall. I'm not familiar with OS X's stealth mode -- what services do you have open that are exposed to the WAN? Are they knocking on TCP 22 (SSH)? Do you have rate limiting enabled in your firewall for port 22?

Also, did you rewrite your IP address for pasting into the question, or is there WAN traffic being forwarded to your NAT address? If the latter, it would be worth activating the filter on your router so that there isn't so much hostile traffic entering your LAN. Only forward the services that are absolutely necessary.

bstpierre
  • 4,968
  • 1
  • 22
  • 34