[BreaksOnDust]

Now I've done my googling and it seems that each case is unique which is why I am turning to you guys.

I checked the log today and it is flooded by these:

[LAN access from remote] from 109.171.52.128:35691 to 192.168.1.18:46118, Monday, January 21,2013 22:58:04
[LAN access from remote] from 23.16.75.29:64714 to 192.168.1.18:46118, Monday, January 21,2013 22:58:01
[LAN access from remote] from 177.42.80.113:17012 to 192.168.1.18:46118, Monday, January 21,2013 22:57:53
[LAN access from remote] from 76.170.148.58:14953 to 192.168.1.18:46118, Monday, January 21,2013 22:57:49
[LAN access from remote] from 79.165.151.213:30275 to 192.168.1.18:46118, Monday, January 21,2013 22:57:44
[LAN access from remote] from 94.42.17.239:54922 to 192.168.1.18:46118, Monday, January 21,2013 22:57:41
[LAN access from remote] from 112.105.139.151:61079 to 192.168.1.18:46118, Monday, January 21,2013 22:57:33
[LAN access from remote] from 24.107.201.105:20433 to 192.168.1.18:46118, Monday, January 21,2013 22:57:29
[LAN access from remote] from 210.79.19.27:41733 to 192.168.1.18:46118, Monday, January 21,2013 22:57:28
[LAN access from remote] from 222.150.87.101:19744 to 192.168.1.18:46118, Monday, January 21,2013 22:57:22
[LAN access from remote] from 198.204.222.39:1025 to 192.168.1.18:46118, Monday, January 21,2013 22:57:18
[LAN access from remote] from 173.93.251.199:10651 to 192.168.1.18:46118, Monday, January 21,2013 22:57:10
[LAN access from remote] from 114.77.39.120:17903 to 192.168.1.18:46118, Monday, January 21,2013 22:57:04
[LAN access from remote] from 202.156.83.13:34674 to 192.168.1.18:46118, Monday, January 21,2013 22:57:01
[LAN access from remote] from 188.251.82.239:39340 to 192.168.1.18:46118, Monday, January 21,2013 22:56:55
[LAN access from remote] from 24.255.163.199:22312 to 192.168.1.18:46118, Monday, January 21,2013 22:56:49
[LAN access from remote] from 101.210.142.33:1026 to 192.168.1.18:46118, Monday, January 21,2013 22:56:44
[LAN access from remote] from 83.143.102.6:55107 to 192.168.1.18:46118, Monday, January 21,2013 22:56:41
[LAN access from remote] from 1.22.60.12:27760 to 192.168.1.18:46118, Monday, January 21,2013 22:56:33
[LAN access from remote] from 58.9.230.159:9186 to 192.168.1.18:46118, Monday, January 21,2013 22:56:30
[LAN access from remote] from 78.36.254.107:11328 to 192.168.1.18:46118, Monday, January 21,2013 22:56:28
[LAN access from remote] from 178.212.105.10:26577 to 192.168.1.18:46118, Monday, January 21,2013 22:56:20
[LAN access from remote] from 108.45.122.13:22360 to 192.168.1.18:46118, Monday, January 21,2013 22:56:18
[LAN access from remote] from 95.71.61.48:51115 to 192.168.1.18:46118, Monday, January 21,2013 22:56:09
[LAN access from remote] from 222.165.21.111:21461 to 192.168.1.18:46118, Monday, January 21,2013 22:56:06
[LAN access from remote] from 46.149.81.90:11733 to 192.168.1.18:46118, Monday, January 21,2013 22:56:01
[LAN access from remote] from 189.124.218.155:29645 to 192.168.1.18:46118, Monday, January 21,2013 22:55:56
[LAN access from remote] from 176.124.160.170:6881 to 192.168.1.18:46118, Monday, January 21,2013 22:55:54
[LAN access from remote] from 117.212.26.185:42756 to 192.168.1.18:46118, Monday, January 21,2013 22:55:50
[LAN access from remote] from 89.208.12.164:41352 to 192.168.1.18:46118, Monday, January 21,2013 22:55:39
[LAN access from remote] from 178.121.251.91:57560 to 192.168.1.18:46118, Monday, January 21,2013 22:55:34
[LAN access from remote] from 113.134.16.14:16001 to 192.168.1.18:46118, Monday, January 21,2013 22:55:31
[LAN access from remote] from 67.228.177.63:33286 to 192.168.1.18:46118, Monday, January 21,2013 22:55:24
[LAN access from remote] from 24.125.235.116:14940 to 192.168.1.18:46118, Monday, January 21,2013 22:55:19
[LAN access from remote] from 177.99.82.139:1025 to 192.168.1.18:46118, Monday, January 21,2013 22:55:16
[LAN access from remote] from 121.237.167.193:62505 to 192.168.1.18:46118, Monday, January 21,2013 22:55:09
[LAN access from remote] from 89.126.31.224:27021 to 192.168.1.18:46118, Monday, January 21,2013 22:55:04
[LAN access from remote] from 92.80.244.38:58299 to 192.168.1.18:46118, Monday, January 21,2013 22:54:59

Router UPnP is not switched on.

Also I noticed that once I closed down my torrent client and cleared the log and then refreshed it these messages stopped appearing. Started the torrent client again and WHAM! There they were again! Strange thing because I had NO active torrents. Not even inactive. No torrents going on at all.

BUT WAIT! It dosen't end here!

I finally switched off utorrent again. Waited for a while and what happens? Cleared and refreshed the logs and from nowhere these [LAN access from remote] started appearing again. And note! With torrent client switched off!

As you may have noticed the foreign IP-adresses differs and so does the port number they're trying to use. And they're only trying to connect to ONE of the machines on the network (192.168.1.18). The one machine that does not run anything. No software, no nothing. Except for virtual box but all those machines were powered off and not hosting or running anything.


So strange?

This post has been edited by BreaksOnDust: 21 January 2013 - 04:43 PM

[modi123_1]

Yes.. that is strange.

Do you have any other apps that might be doing something when not in use? Skype?

[BreaksOnDust]

Nope, nothing. It seems as if they're all trying to connect to port 46118. According to speedguide.net that port is unassigned.

I ran a 'netstat -o' to see if there were any process (checking for process PID number) running on that port. Nothing.

Could it just be that that the process is not listed when running 'netstat -o'? Or Could it be some kind of rootkit?

Disregard this. uTorrent (with randomized port) was open by autostart. My bad.
Still find it interesting that it dosen't show up on netstat though.

This post has been edited by BreaksOnDust: 22 January 2013 - 05:42 PM