Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm getting these periodical console messages on my Mac:

7/22/11 8:01:03.925 AM Firewall: Stealth Mode connection attempt to UDP from
7/22/11 8:01:05.885 AM Firewall: Stealth Mode connection attempt to UDP from
7/22/11 8:01:09.926 AM Firewall: Stealth Mode connection attempt to UDP from

Ran whois and got:

inetnum: -
netname:        CVIDIA
descr:          CVIDIA  ltd
country:        il
admin-c:        OH341-RIPE
tech-c:         OH341-RIPE
status:         ASSIGNED PA
mnt-by:         QOS-ISP-MNT
source:         RIPE # Filtered

Checked where the IP leads to, it leads here:

I've read the port 2703 is used for SMS chat, but also might be used by a trojan.

Should I be worried?

share|improve this question

Short answer:

It's very unlikely that this poses a threat to your machine.

Long answer:

Unless you have a program running on your machine that is receiving the packets [typically called a daemon], the system won't be affected. It might be a good idea to do a UDP port scan with a program like Nmap to figure out whether that port is open.

Since this is UDP [known colloquially as the "Unimportant Data Protocol"], which requires that the program on the receiving end initiate an outgoing connection in order for the sender to have ANY idea if it's getting through, this probably isn't a probe attempt. Most network scanners use TCP SYN packets to scan if a port is open or not. Chances are that this is just a matter of just sending its packets to the wrong host. Maybe the remote host is just spewing out UDP packets to port 2703 of every host the Internet.

If you're really concerned, you can set your firewall to block all packets from that host, or close the port off completely if you're not using it.

I used to get really concerned when I'd get log messages saying that unsolicited packets were arriving on closed ports, but it never amounted to anything. Now I don't even look at the messages.

share|improve this answer
Re "Maybe the remote host is just spewing out UDP packets to port 2703 of every host the Internet", how could that be likely? – Pacerier Nov 9 '15 at 19:49

Your firewall software is scaring you unnecessarily. First: "stealth mode" isn't stealthy at all. It just means that your machine hasn't sent an ICMP /IP"port unreachable" response to the incoming datagrams. Second: UDP/IP is connectionless, unlike TCP/IP, so there has been no "connection attempt" at all.

UDP/IP port 2703 is used by Microsoft System Management Server for its "remote chat" function. Someone on that IP address is using SMS to try to perform a Remote Chat with you, or whoever used your IP address before you. This could be benign, someone who doesn't know that whoever had your IP address before is no longer using that address, or it could be malicious, someone looking to see whether you have the SMS Client installed insecurely so that xe can try to use its remote control functions to take over your machine.

But since your firewall is simply dropping the inbound UDP/IP traffic on the floor, without even sending an ICMP/IP response, in either case there's no cause for action on your part.

share|improve this answer
This should be the accepted answer. – Pacerier Nov 9 '15 at 19:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.