Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a 2701HGV-B 2Wire modem and router (AT&T). The log is basically full with entries similar to the following with a time between a fifth and a third of a second between entries:

src= ipprot=17 sport=6882 dport=1701 Unknown inbound session stopped
src= ipprot=17 sport=21573 dport=1701 Unknown inbound session stopped
src= ipprot=17 sport=25902 dport=1701 Unknown inbound session stopped

where the source IP will be different for every entry. The entries accumulate constantly, every single second that the router is on several of them appear in the log. The destination is the WAN address for my router. I understand that this is somehow related to VNCs, but I don't know enough to figure out why my router is getting bombarded with requests for a VNC session. Is there anything fishy going on or is this normal? If it is normal, how do I keep these entries from spamming my log files? Since there's about two or three of them every second, everything else gets drowned out.

share|improve this question
Are you attempting to VPN? or perhaps someone is trying to connect to your IP to start a VPN session. Port 1701 is used for L2TP VPN: – freedenizen Nov 23 '11 at 5:53
No, I am not attempting to VPN and I can't imagine any reason for thousands of different IPs from the internet trying to VPN to my machine. – vlsd Nov 23 '11 at 19:14
up vote 2 down vote accepted

IP Protocol 17 is UDP, and as mentioned in the comments, UDP/1701 is the port commonly used for L2TP, a VPN protocol.

L2TP has had some vulnerabilities reported so two mostl likely scenarios are

  1. A PC has been compromised and is being used to scan for vulnerable L2TP implementations, and your IP has been scanned
  2. Your IP address has been previously used by someone else, who was actually running an L2TP gateway, and one of the clients to that gateway is still attempting to contact it.

The source address is part of the UK ISP BTs range, so probably a domestic connection.

In any case, your firewall is blocking it, it is doing its job. If you watch your external connection you will see many attempts to connect to ports on your IP address. This is just the background radiation of the internet, zombie PCs doing scans.

You can safely ignore it.

share|improve this answer
Thanks for the thorough answer. Neither 1 nor 2 fully explain what's going on here though. The thing is, there are a lot of requests like this every second, each from a different source IP, and always on UDP 1701. If this is just background internet radiation, why does it look so uniform? I can't imagine everyone on the internet is getting bombarded with 5 VPN requests every second they are connected. – vlsd Nov 23 '11 at 16:43
now it's logging crazy amount of activity on port 445. i guess it really was just background radiation. – vlsd Nov 26 '11 at 22:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .