• Welcome to Overclockers Forums! Join us to reply in threads, receive reduced ads, and to customize your site experience!

Invalid TCP source port. A Trojan??

Overclockers is supported by our readers. When you click a link to make a purchase, we may earn a commission. Learn More.

Runner30

Member
Joined
Apr 3, 2004
Hello.

I'm using NIS 2004 and am constantly alerted about blocked connection with invalid port (0).

Am I in danger? :eh?:

Thanks.
 

turd

Member
Joined
Sep 16, 2001
Well it could be that someone just tried to finger your system (determine OS) pretty common basic scan stuff. Seems like NPF dropped it(stealth) so everything is OK. This is my guess, someone could know more.
 

Smokeys

Member
Joined
May 24, 2003
Location
Toronto, Ontario
If its showing as blocked, then your computer really never recieved it and your firewall did its job.

If you us to tell you exactrly what it may be then please paste the log entry.
 
OP
Runner30

Runner30

Member
Joined
Apr 3, 2004
HEre are the details as they appear in log:

Details: Intrusion: Invalid TCP Source Port
Intruder: 201.8.229.107
Risk Level: Low
Source IP address: 201.8.229.107
Destination IP address: l192-117-##-##.tcable.actcom.net.il(192.117.##.###)
TCP Source Port: 0. This is an invalid port number.
TCP Destination Port: 0

Click on the address to trace the attacker
You can get detailed information about this attack at Symantec Security Response


Symantec Security Response categorizes it as "suspicious activity, fingerprinting/profiling of the system".

Is it possible that I already have a Trojan, and the firewall blocked the connection?
 
Last edited:

Smokeys

Member
Joined
May 24, 2003
Location
Toronto, Ontario
The connection was to you, not going out, so its just the 'normal' background noise of scans and other people with trojans, there is nothing to worry about.