QUOTE(klseet @ Sep 7 2010, 01:35 PM)
It's persistent attempts rom the same IP, keep changing TCP ports from 1xxx to 4xxx
even got port number labeled with radacct, zephyr-clt, etc ....
it seem to me some kind of random port scan & attempt to comes in, an act resemble hacking ....
So is this kind of action "normal" for UniFi ??
This kind of action is "normal" for the Internet.
With the whole world connected, there's bound to be a few thousand hackers out there scanning ports and IPs, and you're bound to get hit by some of them.
QUOTE(klseet @ Sep 7 2010, 01:35 PM)
Yes, I'm lucky behind NAT+Firewall, but I do have some ports mapping running behind NAT, what if it manage to scan and got the right port??
and what about those without firewall??
Sigh, this is really annoying and I only realise now .....
If it manages to scan and get a port that is open, it will be able to communicate with whatever application you have mapped to the port. Most of the time, if it doesn't speak the right "language" for that applications communications, nothing much will happen, usually the app will just hang up and wait for the next connection.
Most apps that give access to critical things (like your data for example) will have some sort of id and password scheme, and so the problem will not get past that.
Where the risk is is that if the app has a bug and the bug is well known and allows some remote exploit, then you have a problem. In fact, this is really what the port scans are looking for. Which is why, if you are opening ports, you are responsible to make sure you keep your software up to date.
Those without firewall/router who run (especially) a windows PC directly on the internet ... deserve what they get! *grin*
This post has been edited by shahada: Sep 7 2010, 03:15 PM