Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Firewalls
[Top] [All Lists]

MAC Address connecting to Port 1

Subject: MAC Address connecting to Port 1
Date: Wed, 13 Jul 2005 16:45:09 +0100
Hi Folks,

Quick n00b question for you all. I recently purchased a D-Link DGL4300 Router with NAT and SPI Firewall built in for my home network. I've disabled wireless access at the moment as im not currently using it and have configured the MAC filter to only allow connections from the 2 PC's i have on my LAN - the router is connected to my cable modem. All is working fine but when i check the logs i get this message regularly, about twice a day.

Wed Jul 13 08:20:05 2005 Access denied to system with MAC address ********** on port 1



The MAC address is not always the same. so it seems something is trying to 
connect on port 1. now I've done a google and found that port 1 belongs to TCP 
Multiplexer and the following definition:




A TCP client connects to a foreign host on TCP port 1. It sends the service name followed by a carriage-return line-feed <CRLF>. The service name is never case sensitive. The server replies with a single character indicating positive ("+") or negative ("-") acknowledgment, immediately followed by an optional message of explanation, terminated with a <CRLF>. If the reply was positive," the selected protocol begins; otherwise the connection is closed.



Just wondering what could be trying to connect to port 1? If it's something 
legitimate or not?

Any help would be much appreciated.

Regards,

fac51


<Prev in Thread] Current Thread [Next in Thread>