Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm getting these periodical console messages on my Mac:

7/22/11 8:01:03.925 AM Firewall: Stealth Mode connection attempt to UDP 10.0.0.1:2703 from 91.143.232.133:15881
7/22/11 8:01:05.885 AM Firewall: Stealth Mode connection attempt to UDP 10.0.0.1:2703 from 91.143.232.133:15881
7/22/11 8:01:09.926 AM Firewall: Stealth Mode connection attempt to UDP 10.0.0.1:2703 from 91.143.232.133:15881

Ran whois 91.143.232.133 and got:

inetnum:        91.143.232.128 - 91.143.232.143
netname:        CVIDIA
descr:          CVIDIA  ltd
country:        il
admin-c:        OH341-RIPE
tech-c:         OH341-RIPE
status:         ASSIGNED PA
mnt-by:         QOS-ISP-MNT
source:         RIPE # Filtered

Checked where the IP leads to, it leads here: https://91.143.232.133/Login/Login

I've read the port 2703 is used for SMS chat, but also might be used by a trojan.

Should I be worried?

share|improve this question

2 Answers 2

Short answer:

It's very unlikely that this poses a threat to your machine.

Long answer:

Unless you have a program running on your machine that is receiving the packets [typically called a daemon], the system won't be affected. It might be a good idea to do a UDP port scan with a program like Nmap to figure out whether that port is open.

Since this is UDP [known colloquially as the "Unimportant Data Protocol"], which requires that the program on the receiving end initiate an outgoing connection in order for the sender to have ANY idea if it's getting through, this probably isn't a probe attempt. Most network scanners use TCP SYN packets to scan if a port is open or not. Chances are that this is just a matter of 91.143.232.133 just sending its packets to the wrong host. Maybe the remote host is just spewing out UDP packets to port 2703 of every host the Internet.

If you're really concerned, you can set your firewall to block all packets from that host, or close the port off completely if you're not using it.

I used to get really concerned when I'd get log messages saying that unsolicited packets were arriving on closed ports, but it never amounted to anything. Now I don't even look at the messages.

share|improve this answer

Your firewall software is scaring you unnecessarily. First: "stealth mode" isn't stealthy at all. It just means that your machine hasn't sent an ICMP /IP"port unreachable" response to the incoming datagrams. Second: UDP/IP is connectionless, unlike TCP/IP, so there has been no "connection attempt" at all.

UDP/IP port 2703 is used by Microsoft System Management Server for its "remote chat" function. Someone on that IP address is using SMS to try to perform a Remote Chat with you, or whoever used your IP address before you. This could be benign, someone who doesn't know that whoever had your IP address before is no longer using that address, or it could be malicious, someone looking to see whether you have the SMS Client installed insecurely so that xe can try to use its remote control functions to take over your machine.

But since your firewall is simply dropping the inbound UDP/IP traffic on the floor, without even sending an ICMP/IP response, in either case there's no cause for action on your part.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.