/var/log/syslog dpt=1079

aikempshall · 10-05-2006, 03:58 PM

Hi

I'm new to firewalls. However, I'm using Guarddog as a frontend to iptables. Also have a router that has an integral firewall. On Your system has achieved a perfect "TruStealth" rating.On the Gibson Research Corporation Shields up Site my system was given "a perfect "TruStealth" rating.".

However monitoring syslog I get

Quote:

Oct 5 20:23:12 LINUX kernel: ABORTED IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=65.54.183.202 DST=10.0.0.4 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=20659 DF PROTO=TCP SPT=80 DPT=1079 SEQ=4158834433 ACK=1308299161 WINDOW=0 RES=0x00 ACK RST URGP=0

Which I believe means that the ipaddress 65.54.183.202 has sent a packet from port 80 to my port 1079 which has been aborted at my end. Googling Port 1079 I've found it's called

Quote:

ASPROVATalk

and 65.54.183.202 is the Microsoft Passport Sign In web page. I'd been on hotmail.

My questions are -

what is port 1079 - ASPROVATALK? Do I need to know?
If Shields UP gives me a TruStealth rating have I done all I can to keep people out?

Thanks

acid_kewpie · 10-05-2006, 05:26 PM

1079 is just the port number your linux box randomly assigned for the outbound communication, and condincidences with existing named ports is of no interest.... so this is you talking to microsoft. anythign else?