Many hits registerd by firestarer

(Blocked) is the operative word for you and is your key. You might want to continue searching with Google or Dogpile.com for the information above that you seek.

Duane :)

Thanks Duane, I hadn't thought of Dogpile.com. I willtake it that Firestarter isdoing a pretty good job sothere'snothing to worry about.

I'll probably post a follow-up once I've checked the logs on the same machine but running Windows XP.

Cheers,

Agustín

You got it. But always watch the logs for outbound connctions to unknown IP(s).

Duane :)

Yes, it says you are wasting CPU cycles and disk space logging this stuff. And most of the crap is automated scans.

That should tell you something about grc.com. If you want real answers, have a trusted friend (preferably on the same ISP) stroke your address with nmap.

I normally complain about such useless information in windoze postings. Malware uses any port that it chooses. They don't register port numbers with IANA. A common comment about these kinds of firewalls:

Their main use is telling the ones who use it that some host in Korea or Kenya attempted to connect to a trojan that they don't have installed.

Yes, many automated worms look for these - hoping to find wide open windoze boxes. Port 27374 has been used by dozens of trojans because it's a nice sounding number that the virus writers can remember.

Often legitimate - block it (REJECT) or allow it if you must, but never stealth or ignore (DROP) the packet. See RFC1413 that may be on your system:

1. INTRODUCTION

The Identification Protocol (a.k.a., "ident", a.k.a., "the Ident Protocol") provides a means to determine the identity of a user of a particular TCP connection. Given a TCP port number pair, it returns a character string which identifies the owner of that connection on the server's system.

Briefly, you try to connect to some server (typically POP or IMAP at your ISP, or most IRC servers), and that server will send a query to port 113 on your system asking "Who is trying to connect to my port XXX?" Your server should respond with "User Joe Blow" or whatever the username. This allows the remote server to know who to complain about if you do something stupid. Many mail and IRC servers require this service. Some will let your connection continue if you REJECT the query, but if you DROP the connection attempt, the remote server will wait a number of seconds (as much as two minutes) before either allowing your connection, or dropping it because they don't know who you are. There are several programs available in Linux that will respond to these queries - look for packages that have the word 'identd' as part of the name.

Not seeing port 445? My ISP blocks that at the border, but I still see plenty of that from other hosts on the ISP network - parading around with their pants around their ankles saying "Take me! Take me!"

Running Linux (or pretty much _any_ operating system other than windoze), you are essentially immune to this crap. Keep your system up to date, and don't run unnecessary services and you can ignore all that noise.

Old guy

Thank you indeed for such a complete response. You've given me a lot to think about - though one point comes through pretty clearly: I should let firestarter keep blocking as it has till now, but cease to log so many of these blocks, as I know they are being carried out effectiviely.

Thanks again,

Agustín