Question : Drop TCP packet from WAN /dlink log - what does it mean?

Hi,
I just noticed these on in my dlink logs.  What does it mean?

Drop TCP packet from WAN      41.220.12.49:3128      10.0.1.10:61333      Rule: Default deny
Drop TCP packet from WAN      199.175.179.210:80      10.0.1.10:60781      Rule: Default deny
Drop TCP packet from WAN      199.175.179.210:80      10.0.1.10:60743      Rule: Default deny
Drop TCP packet from WAN      199.175.179.210:80      10.0.1.10:60781      Rule: Default deny
Drop TCP packet from WAN      199.175.179.210:80      10.0.1.10:60781      Rule: Default deny
Drop TCP packet from WAN      199.175.179.210:80      10.0.1.10:60743      Rule: Default deny
Drop TCP packet from WAN      41.220.12.49:3128      10.0.1.10:60707      Rule: Default deny
Drop TCP packet from WAN      209.85.133.19:443      10.0.1.10:60604      Rule: Default deny
Drop TCP packet from WAN      209.85.133.19:443      10.0.1.10:60604      Rule: Default deny
Drop TCP packet from WAN      209.85.133.19:443      10.0.1.10:60604      Rule: Default deny

Thanks
T

Answer : Drop TCP packet from WAN /dlink log - what does it mean?

What it says - someone "out there" on the internet attempted to make a connection to your system, your firewall has a rule which says not to let these people in - actually it's a default rule, that is, what the firewall does in the absense of any more specific instruction) so it just drops the packet. That is to say, ignores it, rather than either passing it, or responding to it in the negative.

The sending machine will just have "timed out".

It's nothing to worry about.

In fact, as a *general* rule, anything you see in your firewall log is nothing to worry about because it means your firewall has detected and acted upon any problem. The things to worry about are the types of attack your firewall doesn't recognise or can't detect, which it can't block, and, of course, it follows, it can't log either.

There are any NUMBER of reasons why some external computer may be trying to access your network. some legitimate mistakes, keying errors, some attempts to see if you have a "bot" infection or other weakness they can exploit for spamming. It's good that you have a firewall* - but don't lose sleep over all the stuff it logs.

* -  recent experiments showed that if you connect an unprotected Windows XP machine (i.e. with no firewall or software-firewall running) the average time between connecting it and it becoming infected with some bot or trojan is about four minutes...

Random Solutions  
 
programming4us programming4us