Steve Siegfried wrote: >Just got probed on what looks to be a new combination of ports: > > > Jul 17 09:42:44 sos kernel: Packet log: input DENY eth1 PROTO=6 FOREIGN_IPADDR:1210 MY_IPADDR:81 L=48 S=0x00 I=46899 F=0x4000 T=105 SYN (#348) > > Jul 17 09:42:44 TCP: port 8000 connection attempt from FOREIGN_IPADDR:1209 > > Jul 17 09:42:44 TCP: port 81 connection attempt from FOREIGN_IPADDR:1210 > > Jul 17 09:42:44 TCP: webcache connection attempt from FOREIGN_IPADDR:1211 > > Jul 17 09:42:44 TCP: port 3128 connection attempt from FOREIGN_IPADDR:1212 > > Jul 17 09:42:45 TCP: port 8000 connection attempt from FOREIGN_IPADDR:1209 > > Jul 17 09:42:45 TCP: webcache connection attempt from FOREIGN_IPADDR:1211 > > Jul 17 09:42:45 TCP: port 3128 connection attempt from FOREIGN_IPADDR:1212 > > Jul 17 09:42:45 TCP: port 8000 connection attempt from FOREIGN_IPADDR:1209 > > Jul 17 09:42:45 TCP: webcache connection attempt from FOREIGN_IPADDR:1211 > > Jul 17 09:42:45 TCP: port 3128 connection attempt from FOREIGN_IPADDR:1212 > > Jul 17 09:42:47 sos kernel: Packet log: input DENY eth1 PROTO=6 FOREIGN_IPADDR:1210 MY_IPADDR:81 L=48 S=0x00 I=48811 F=0x4000 T=105 SYN (#348) > > Jul 17 09:42:47 TCP: port 81 connection attempt from FOREIGN_IPADDR:1210 > > Jul 17 09:42:54 sos kernel: Packet log: input DENY eth1 PROTO=6 FOREIGN_IPADDR:1210 MY_IPADDR:81 L=48 S=0x00 I=52954 F=0x4000 T=105 SYN (#348) > > > >Anybody seen this before and/or know what it is? > > Look at this listing of public proxies. Notice the common ports used? http://tools.rosinstrument.com/proxy/ It looks like someone was scanning to see if you had a public proxy running. Brent Metzler 612-270-0119 brent at bmetzler.org