up vote 1 down vote favorite
share [g+] share [fb]

I'm using MacOS X 10.6.8 and my logfile daily.log if full of lines like that:

Sun Jan 29 09:51:47 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:51855 from 192.168.2.1:53

192.168.2.1 is the LAN IP of my router, 192.168.2.49 is the IP of my Mac.

I wonder:

  • Do I have to worry?

I found a similar question ( Weird hits on port 2703 ), but there it seems to be always the same port 2703 and it comes from an external IP address, so I'm not sure if it's the same thing.

The other problem is: It fills up my log file daily.log quickly, which already has a size of 2,7 GB!

So, if this should be no reason to worry, is there a way to disable the continuous production of new lines in the log file?

Sun Jan 29 09:51:47 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:51855 from 192.168.2.1:53
Sun Jan 29 10:00:22 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:49972 from 192.168.2.1:53
Sun Jan 29 10:01:46 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:52317 from 192.168.2.1:53
Sun Jan 29 10:11:49 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:65055 from 192.168.2.1:53
Sun Jan 29 10:13:14 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:65439 from 192.168.2.1:53
Sun Jan 29 10:22:24 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:61231 from 192.168.2.1:53
Sun Jan 29 10:22:31 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:65419 from 192.168.2.1:53
Sun Jan 29 10:41:04 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:59362 from 192.168.2.1:53
Sun Jan 29 10:41:38 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:49793 from 192.168.2.1:53
Sun Jan 29 10:41:48 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:64922 from 192.168.2.1:53
Sun Jan 29 10:42:19 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:62376 from 192.168.2.1:53
Sun Jan 29 10:47:09 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:53441 from 192.168.2.1:53
Sun Jan 29 10:47:26 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:64847 from 192.168.2.1:53
Sun Jan 29 10:47:31 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:59459 from 192.168.2.1:53
Sun Jan 29 10:47:34 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:50163 from 192.168.2.1:53
Sun Jan 29 10:47:34 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:51454 from 192.168.2.1:53
Sun Jan 29 10:47:34 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:56510 from 192.168.2.1:53
Sun Jan 29 10:52:38 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:59546 from 192.168.2.1:53
Sun Jan 29 10:52:38 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:62730 from 192.168.2.1:53
Sun Jan 29 10:52:46 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:58754 from 192.168.2.1:53
Sun Jan 29 10:52:48 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:64268 from 192.168.2.1:53
Sun Jan 29 11:24:08 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:59974 from 192.168.2.1:53
Sun Jan 29 11:41:20 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:65478 from 192.168.2.1:53
Sun Jan 29 11:41:24 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:52758 from 192.168.2.1:53
Sun Jan 29 11:41:25 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:64679 from 192.168.2.1:53
Sun Jan 29 11:41:59 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:63220 from 192.168.2.1:53
Sun Jan 29 12:11:59 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:58767 from 192.168.2.1:53
Sun Jan 29 13:07:56 nameofmymac Firewall[77] : Stealth Mode connection attempt to UDP 192.168.2.49:55906 from 192.168.2.1:53

link|improve this question
25% accept rate
feedback

2 Answers

up vote 2 down vote

No, it's not the same thing. It's replies to DNS queries from a DNS server, as noted in another answer.

Terry Lambert has some not very complimentary things to say about the MacOS firewall that make for interesting reading. Misleading poor novice administrators into thinking that there are such things as UDP/IP "connections" is apparently not its only dunderheaded flaw.

Further reading

link|improve this answer
feedback
up vote 1 down vote

You don't need to worry.

Stealth mode makes you machine ignore (rather than reject) connections initiated from outside (e.g. portscan); as if there isn't any computer at all at the particular IP address.

In general Stealth Mode entries may be an issue, but these are coming from the DNS port of your router (192.168.2.1:53). Most likely what happens is that your machine sends a DNS request to the router, but the response gets back slower than expected and the firewall thinks that it is a different connection that is initiated from outside. It is unlikely that the connection between your machine and the router is slow, most likely the external DNS server that you are using (either your ISP's or OpenDNS or one of the public DNS services) is responding slower.

I haven't found a way to stop just the log entries from DNS server without turning off Stealth Mode.

link|improve this answer
what would it mean to turn off Stealth Mode? – Martin Jan 31 at 22:43
1  
It means that the computer would respond to connections (including pings) initiated from outside by sending rejection to the IP address that initiated the connection. This way a potential attacker would know that there is a computer at that IP address, the OS you are running etc. However if your computer is always behind a router and if you trust the machines in your local network this shouldn't be an issue, because the router would stop the outside connections. – lupincho Feb 1 at 8:26
Another way to reduce these entries would be to try to set different DNS servers in the router. Many people use OpenDNS, Google's public DNS servers etc. http://www.tech-faq.com/public-dns-servers.html – lupincho Feb 1 at 8:33
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.