From owner-freebsd-questions Tue Jan 1 9:22:12 2002 Delivered-To: freebsd-questions@freebsd.org Received: from mail.mango-bay.com (mail.mango-bay.com [208.206.15.12]) by hub.freebsd.org (Postfix) with ESMTP id ED85337B41F for ; Tue, 1 Jan 2002 09:22:10 -0800 (PST) Received: from barbish ([63.70.155.19]) by mail.mango-bay.com (Post.Office MTA v3.5.3 release 223 ID# 0-52377U2500L250S0V35) with SMTP id com for ; Tue, 1 Jan 2002 12:24:36 -0500 From: "Joe & Fhe Barbish" To: "FBSD Questions" Subject: IPFW UDP port# 520 Date: Tue, 1 Jan 2002 12:22:08 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Importance: Normal Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Happy new year to all FBSD list readers. I see in my security log a lot of denied packets over and over again of the same kind. Deny UDP 208.203.25.3:520 63.163.61.14:520 in via tun0 208.203.25.3 is my ISP's IP address and 63.163.61.14 is my IP address. When I lookup what port 520 is it says a local routing process or Trojan Ripper. I think it's my ISP's front door router inquiring if I am still there. Since my firewall is denying the request it just keeps repeating. How can I be sure It's my ISP's router and not the Ripper Trojan? What rules do I need the add to my IPFW rules set to resolve this? Thanks Joe To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message