I have only recently started looking at my logs (Logwatch - FC3), and trying to learn how to harden my defenses within a 'reasonable' limit.

Every day, I get a report that includes information similar to this:

From IP ------------ Hits --- Prtcl ------- Ports
61.235.154.92 --- 140 --- udp --- (1026-1027)
61.53.154.81 ------ 99 --- udp --- (1026-1027)
61.152.158.101 --- 95 --- udp --- (1026-1027)
222.136.251.113 - 34 --- udp --- (1026-1027)
220.168.156.71 --- 34 --- udp --- (1026-1027)
61.152.158.152 --- 26 --- udp --- (1026-1027)
222.189.38.2 ------- 23 --- udp --- (1026-1027)
222.241.95.8 ------- 20 --- udp --- (1026-1027)
61.152.158.151 --- 20 --- udp --- (1026-1027)
218.66.104.140 --- 18 --- udp --- (1026-1027)
222.88.173.5 ------- 15 --- udp --- (1026)
61.53.154.89 ------- 15 --- udp --- (1026-1027)
61.152.158.124 ---- 14 --- udp --- (1026-1027)
61.53.154.93 ------- 14 --- udp --- (1026-1027)
61.172.246.74 ----- 14 --- udp --- (1026-1027)
218.66.104.139 ---- 13 --- udp --- (1026-1027)
61.152.158.123 ---- 13 --- udp --- (1026-1027)
218.83.153.58 ------ 12 --- udp --- (1026)
70.85.177.130 ------ 12 --- udp --- (1026-1027)
222.136.251.121 --- 11--- udp --- (1026-1027)
61.152.239.134 ----- 11 --- udp --- (1026-1027)
61.152.158.150 ----- 11 --- udp --- (1026-1027)
61.152.158.111 ---- 10 --- udp --- (1026-1027)

(Hmmm! Is there a way to post a nicely formatted table?)

Anyway, it seems obvious to me that nobody in China has any business hitting my ports 1026 & 1027 with 140 udp packets. I rather suspect that the IP's are spoofed anyway, and that simply firewalling out those specific ones will not gain me much.

I just installed PortSentry, but I'm not sure it'll do anything since the probes are (evidently) being stopped by the firewall.

What's my next step ... or should I even be concerned?

I'd be concerned if it stopped - it means your Internet connection is down.

Seriously, I've been seeing the same activity for years. As long as you keep your software current, you've got nothing to worry about.

PS- use a code block to post formatted information.

I find it interesting that they're hitting ports 1026 & 1027. PortSentry's defaults are to watch any port below 1025. Would it be a good idea to raise that portwatch number to 1028.

Don't bother; the ports don't relate to Linux services, and so aren't normally open. It's just Microsoft-targeting spam looking for an unsuspecting victim.

OK. After reading the links you posted, and following a couple there, I solved the problem. Told my firewall to quit logging hits on 1026 & 1027.

OK. Day 2.

Interesting issues (to me) this time are people who came back to visit again ... Seems to eliminate pure randomness. I've added a few items, Visit Nbr., Geograhical source of probe, and Apps (or Trojans) known to use this port. I've also had a few probes at Ports 80 & 8080Should be no issue there as long as I'm not running a www. server, right?

Mr. Brazil has got to go. I guess the best way to do that is add his IP to /etc/hosts.deny? I didn't find anything about that port, but I suspect it's a p2p filesharing program of some kind. For whatever reason, he's locked in on me, and that makes me uncomfortable.

I assume the sql ports are people who's machines are infected with the identified worms, looking for companionship. Shouldn't be a problem I don't think, since I don't run MSSQL or MySql. I do run Postgres, tho, but it's port is not open to incoming, only outgoing. Nobody hit that one yet anyway.

Gnutella doesn't concern me as long as I don't see the same IPs too often (like Mr Brazil).

The Comcast probes bother me slightly. That's my ISP. Are they checking up on me, or what. Had a few probes from them on Port 80, as well.

Any commentary appreciated. I am learning.

It's unlikely it's random; more likely to be an infected set of machines. Machines frequently get multiply infected, as I can attest from cleaning 50+ nasties out of a single family member machine.

Even if you are running a web server, if the firewall doesn't permit access to those IP addresses, it doesn't matter.

If the port is firewalled or has no listening application, no further action is necessary.

It's likely other Comcast users are infected. That's not to say that your ISP doesn't check on you; they simply don't need to probe your ports. Remember that your traffic runs thru their equipment, so they can know (if they are interested), every port that you have active.