Author Topic: Security alert emails DNS  (Read 1756 times)

0 Members and 1 Guest are viewing this topic.

ratcateme

  • Guest
Security alert emails DNS
« on: January 19, 2009, 08:56:51 AM »
i have received a security alert email from avast today:
Code: [Select]
No.001  Mon, 2009-01-19 15:21:08 - UDP Packet - Source:203.109.129.67 Destination:118.92.***.*** - [Firewall Log-PORT SCAN]
...
No.009  Mon, 2009-01-19 15:21:09 - UDP Packet - Source:203.109.129.67 Destination:118.92.***.*** - [Firewall Log-PORT SCAN] No.010  Mon, 2009-01-19 15:21:13 - UDP Packet - Source:203.109.129.68 Destination:118.92.***.*** - [Firewall Log-PORT SCAN]
No.011  Mon, 2009-01-19 15:21:13 - UDP Packet - Source:203.109.129.68 Destination:118.92.***.*** - [Firewall Log-PORT SCAN]
...
No.019  Mon, 2009-01-19 15:21:16 - UDP Packet - Source:192.203.230.10 Destination:118.92.***.*** - [Firewall Log-PORT SCAN] No.020  Mon, 2009-01-19 15:21:16 - UDP Packet - Source:192.203.230.10 Destination:118.92.***.*** - [Firewall Log-PORT SCAN]
a quick look around i noticed 203.109.129.67 and 203.109.129.68 are the DNS servers given to by my ISP.
i did a nslookup on 192.203.230.10 and it turns it is DNS root server E.
118.92.***.*** is my external IP the PC that received these errors is behind a router running NAT
so the only thing i could see happening is that it sent a DNS request to 203.109.129.67 or 203.109.129.68 (both are listed as DNS servers in my IP Config)
but i can't see how it could be talking to 192.203.230.10
can someone enlighten me on what is going on.
Thanks

Scott.

Offline lukor

  • Administrator
  • Super Poster
  • ***
  • Posts: 1883
    • AVAST Software
Re: Security alert emails DNS
« Reply #1 on: January 19, 2009, 09:48:13 AM »
The log format does not seem to be from avast! Isn't it your firewall that sends you alerts?

ratcateme

  • Guest
Re: Security alert emails DNS
« Reply #2 on: January 19, 2009, 11:49:21 AM »
sorry your right i was sure i setup some SMTP settings in avast but i check and they are not there i just assumed they cam from avast because i didn't get them until i install avast
they might be coming from my router i will have to look into it

Scott.