Hi everyone!

Lately my Linux-router logs the following message when setting up a ppp-connection:

[pppd] open TCP 10.1.1.1:xxxxx -> 10.2.2.2:1214

Where 10.1.1.1 is my current inet - address and 10.2.2.2 is another valid inet-address.

Some I could identify using nslookup, others weren't registered... The ones I could identify didn't look like any servers from my ISP. it was something like hc6523a5f.dhcp.vt.edu
Does anyone know what port 1214 is good for? should I worry about these connects?
My firewall is set to allow incoming highports on all devices.

Thanx, steave.

I found an article you might like: http://www.tech-report.com/news_reply.x/2667
Seems port 1214 is bound to Morpheus (the file sharing proggie). The connections you are seeing are from your private network (10.x.x.x shows you they are on your network, at school apparently).
Might be harmless connections to you if you are sharing files by morpheus, or probes on that port, maybe something to worry about. Dunno.

Thanx, the addresses were actually more like 217.154.33.48 so, they were real addresses. I found out that morpheus is apparrently using port 1214 for communication. I'm still wondering why my pppd logs the first connection although its masqueraded traffic that doesn't really have anything to do with the pppd. hmmm.