Worried re lots of UDP in and out

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Greetings,

I've always thought my XP machine was clean and secure. Now I'm not so sure.
I install all security upgrades immediately, I use Firefox instead of IE, and
get all my email on my Macintosh. I have Norton Internet Security installed
and update it once per week.

Today I installed PeerGuardian2. I think it's configured correctly. The log
shows an awful lot of UDP activity. Like at least a couple of items per
second. The source often seems not to be my machine. The destination IP is
usually completely unfamiliar, often with a high port number -- 4,000 to
50,000 or so. I'm connected to the internet over an unprotected wifi
connection. It's not mine, so I don't know how it's configured. (I'm careful
not to send passwords and credit card numbers over this connection, of
course.)

The PeerGuardian2 documentation doesn't have anything to say on this topic.
I don't know what to think. I looked at Norton Internet Security pretty
carefully. It seems configured correctly.

I tried the same machine on my Macintosh wifi router, which is password
protected, and acts like a hardware firewall. All the "source" UPD
connections that show up on the PeerGuardian2 log are clearly from my own
machine. The number of "Destination" UDPs logged is a lot smaller, I see only
a few port numbers, and they all look like they might be legitimate. I tried
a P2P client over this connection. It does work.

Obviously, I don't understand this topic very well. I hope someone will be
kind enough to advise me a bit. My main question -- Is this something to
worry about?

Thanks in advance,

SNAT
 
If you have not scanned your computer for malware, spyware, and trojans [use
something like Ewido to check for trojans] recently that is something you
should do using the latest definitions for any such program. Such can
account for unusual and unexpected activity. But it may be normal network
traffic. A couple items per second is not a lot. Try downloading TCPView
from SysInternals that will show port usage in real time and the owning
process/executable that can help you track down what is going on and make
sure your software firewall is configured correctly by going to a self scan
site such as http://scan.sygatetech.com/ to see if any basic vulnerabilities
are found. --- Steve
 
Back
Top