MacOS X: log is full of "stealth mode connection attempt"s from LAN router

Question

MacOS X's logfile daily.log is full of lines like this:

Sun Jan 29 09:51:47 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:51855 from 192.168.2.1:53<br/>
Sun Jan 29 10:00:22 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:49972 from 192.168.2.1:53<br/>
Sun Jan 29 10:01:46 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:52317 from 192.168.2.1:53<br/>
Sun Jan 29 10:11:49 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:65055 from 192.168.2.1:53<br/>
Sun Jan 29 10:13:14 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:65439 from 192.168.2.1:53<br/>
Sun Jan 29 10:22:24 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:61231 from 192.168.2.1:53<br/>
Sun Jan 29 10:22:31 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:65419 from 192.168.2.1:53<br/>
Sun Jan 29 10:41:04 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:59362 from 192.168.2.1:53<br/>
Sun Jan 29 10:41:38 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:49793 from 192.168.2.1:53<br/>
Sun Jan 29 10:41:48 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:64922 from 192.168.2.1:53<br/>
Sun Jan 29 10:42:19 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:62376 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:09 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:53441 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:26 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:64847 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:31 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:59459 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:34 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:50163 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:34 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:51454 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:34 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:56510 from 192.168.2.1:53<br/>
Sun Jan 29 10:52:38 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:59546 from 192.168.2.1:53<br/>
Sun Jan 29 10:52:38 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:62730 from 192.168.2.1:53<br/>
Sun Jan 29 10:52:46 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:58754 from 192.168.2.1:53<br/>
Sun Jan 29 10:52:48 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:64268 from 192.168.2.1:53<br/>
Sun Jan 29 11:24:08 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:59974 from 192.168.2.1:53<br/>
Sun Jan 29 11:41:20 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:65478 from 192.168.2.1:53<br/>
Sun Jan 29 11:41:24 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:52758 from 192.168.2.1:53<br/>
Sun Jan 29 11:41:25 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:64679 from 192.168.2.1:53<br/>
Sun Jan 29 11:41:59 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:63220 from 192.168.2.1:53<br/>
Sun Jan 29 12:11:59 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:58767 from 192.168.2.1:53<br/>
Sun Jan 29 13:07:56 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:55906 from 192.168.2.1:53<br/>

Is this something to worry about?

---

• On MacOS X 10.6.8.

• 192.168.2.1 is the LAN IP of my router, 192.168.2.49 is the IP of my Mac.

• It also fills up my log file daily.log quickly, which already has a size of 2,7 GB! (Is there a way to disable the continuous production of new lines in the log file?)

• I've read Weird hits on port 2703 but this seems to be a different thing.

Answer 1

You don't need to worry.

Stealth mode makes you machine ignore (rather than reject) connections initiated from outside (e.g. portscan); as if there isn't any computer at all at the particular IP address.

In general Stealth Mode entries may be an issue, but these are coming from the DNS port of your router (192.168.2.1:53). Most likely what happens is that your machine sends a DNS request to the router, but the response gets back slower than expected and the firewall thinks that it is a different connection that is initiated from outside. It is unlikely that the connection between your machine and the router is slow, most likely the external DNS server that you are using (either your ISP's or OpenDNS or one of the public DNS services) is responding slower.

I haven't found a way to stop just the log entries from DNS server without turning off Stealth Mode.

Answer 2

No, it's not the same thing. It's replies to DNS queries from a DNS server, as noted in another answer.

Terry Lambert has some not very complimentary things to say about the MacOS firewall that make for interesting reading. Misleading poor novice administrators into thinking that there are such things as UDP/IP "connections" is apparently not its only dunderheaded flaw.

Further reading

• Terry Lambert (2011-03-12). Re: Flooded with "Stealth Mode connection attempt"s. Apple Support Communities.