blocked packet

Feb 16, 2008 1 Replies

could someone tell me what this packet is trying to do. port 35268 is my utorrent port. sorry for the bad format of the info. taken from pc tools firewall.


"Time" "Log Type" "Rule Name" "Action" "Direction" "Rule Type" "Adapter Zone" "Data Length" "Ethernet Source" "Ethernet Dest" "Ethernet Type" "IP Source" "IP Dest" "Protocol" "Port Src" "Port Dest" "2008/02/15 15:52:29" "eLogType_Packet" "All other packets" "0" "Inbound" "0" "FWInternetZone" "161" "00:14:2A:A5:F1:CC" "01:00:5E:40:98:8F" "IP" "192.168.2.5" "239.192.152.143" "UDP" "6771" "6771"



data


0000:42 54 2D 53 45 41 52 43 BT-SEARC
0008:48 20 2A 20 48 54 54 50 H * HTTP
0010:2F 31 2E 31 0D 0A 48 6F /1.1..Ho
0018:73 74 3A 20 32 33 39 2E st: 239.
0020:31 39 32 2E 31 35 32 2E 192.152.
0028:31 34 33 3A 36 37 37 31 143:6771
0030:0D 0A 50 6F 72 74 3A 20 ..Port:
0038:33 35 32 36 38 0D 0A 49 35268..I
0040:6E 66 6F 68 61 73 68 3A nfohash:
0048:20 46 45 32 30 33 45 36 FE203E6
0050:37 39 32 38 44 35 45 31 7928D5E1
0058:32 36 45 41 32 45 43 41 26EA2ECA
0060:45 37 41 38 32 39 41 41 E7A829AA
0068:42 33 37 37 45 45 31 41 B377EE1A
0070:37 0D 0A 0D 0A 0D 0A 7......

Toy firewall produces toy results. What you show isn't all that informative.

[compton ~]$ etherwhois 00:14:2A 00-14-2A (hex) Elitegroup Computer System Co., Ltd 00142A (base 16) Elitegroup Computer System Co., Ltd No.22, Alley 38, Lane 91, Sec. 1, Nei Hu Road Taipei 114 TAIWAN, REPUBLIC OF CHINA [compton ~]$

Some Taiwanese clone manufacturer, probably a RealTek 8139 chipset (a common 10/100BaseT NIC) - the 01:00:5E is a Multicast destination, relatively meaningless because of the lack of IP header information.

192.168.2.5 is on your network somewhere - 239.192.152.143 is am "Organization-Local Scope" multicast address - see RFC2365. It's UDP with a source and destination port of 6771 - which is relatively meaningless without knowing what software you've installed. The "data" you show appears to be a BTrieve request, but you'll have to figure out why your "192.168.2.5" host is attempting to send this as a UDP datagram to a local multicast - as that doesn't exactly smell right.

So, what did you install on your windoze box?

Old guy

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required