Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Here's a small sample from my firewall log:

Sep 24 14:51:04 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=213.5.110.105 DST=10.1.1.3 LEN=131 TOS=00 PREC=0x00 TTL=107 ID=32225 PROTO=UDP SPT=17667 DPT=1024 LEN=111 
Sep 24 14:51:05 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=67.183.116.234 DST=10.1.1.3 LEN=58 TOS=00 PREC=0x00 TTL=108 ID=12282 PROTO=UDP SPT=49001 DPT=1024 LEN=38 
Sep 24 14:51:06 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=121.215.144.93 DST=10.1.1.3 LEN=58 TOS=00 PREC=0x00 TTL=114 ID=13981 PROTO=UDP SPT=47838 DPT=1024 LEN=38 
Sep 24 14:51:07 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=186.78.12.237 DST=10.1.1.3 LEN=131 TOS=00 PREC=0x00 TTL=103 ID=21921 PROTO=UDP SPT=43598 DPT=1024 LEN=111 
Sep 24 14:51:08 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=70.79.87.231 DST=10.1.1.3 LEN=58 TOS=00 PREC=0x00 TTL=49 ID=49669 CE PROTO=UDP SPT=61409 DPT=1024 LEN=38 
Sep 24 14:51:08 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=67.183.116.234 DST=10.1.1.3 LEN=58 TOS=00 PREC=0x00 TTL=109 ID=12863 PROTO=UDP SPT=49001 DPT=1024 LEN=38 
Sep 24 14:51:08 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=68.82.79.108 DST=10.1.1.3 LEN=58 TOS=00 PREC=0x00 TTL=106 ID=2122 PROTO=UDP SPT=60001 DPT=1024 LEN=38 
Sep 24 14:51:09 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=75.176.7.91 DST=10.1.1.3 LEN=48 TOS=00 PREC=0x00 TTL=104 ID=30826 PROTO=UDP SPT=14846 DPT=1024 LEN=28 
Sep 24 14:51:10 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=178.150.113.244 DST=10.1.1.3 LEN=131 TOS=00 PREC=0x00 TTL=101 ID=183 PROTO=UDP SPT=35691 DPT=1024 LEN=111 
Sep 24 14:51:11 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=68.82.79.108 DST=10.1.1.3 LEN=58 TOS=00 PREC=0x00 TTL=106 ID=2678 PROTO=UDP SPT=60001 DPT=1024 LEN=38 
Sep 24 14:51:12 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=37.112.250.231 DST=10.1.1.3 LEN=129 TOS=00 PREC=0x00 TTL=109 ID=10057 PROTO=UDP SPT=43146 DPT=1024 LEN=109 
Sep 24 14:51:12 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=70.79.87.231 DST=10.1.1.3 LEN=58 TOS=00 PREC=0x00 TTL=49 ID=38728 CE PROTO=UDP SPT=61409 DPT=1024 LEN=38 
Sep 24 14:51:12 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=68.82.79.108 DST=10.1.1.3 LEN=48 TOS=00 PREC=0x00 TTL=106 ID=2838 PROTO=UDP SPT=60001 DPT=1024 LEN=28 
Sep 24 14:51:13 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=76.109.233.94 DST=10.1.1.3 LEN=48 TOS=00 PREC=0x00 TTL=107 ID=21250 PROTO=UDP SPT=25677 DPT=1024 LEN=28 
Sep 24 14:51:15 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=68.82.79.108 DST=10.1.1.3 LEN=48 TOS=00 PREC=0x00 TTL=106 ID=3251 PROTO=UDP SPT=60001 DPT=1024 LEN=28 
Sep 24 14:51:15 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=76.109.233.94 DST=10.1.1.3 LEN=48 TOS=00 PREC=0x00 TTL=108 ID=22226 PROTO=UDP SPT=25677 DPT=1024 LEN=28 
Sep 24 14:51:16 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=76.109.233.94 DST=10.1.1.3 LEN=48 TOS=00 PREC=0x00 TTL=108 ID=22354 PROTO=UDP SPT=25677 DPT=1024 LEN=28 
Sep 24 14:51:16 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=76.109.233.94 DST=10.1.1.3 LEN=48 TOS=00 PREC=0x00 TTL=108 ID=22411 PROTO=UDP SPT=25677 DPT=1024 LEN=28 
Sep 24 14:51:18 server Shorewall:net2fw:DROP: IN=eth0 OUT= MAC=44:87:fc:8a:f2:c3:00:04:ed:dd:e6:4a:08:00  SRC=76.177.141.11 DST=10.1.1.3 LEN=48 TOS=00 PREC=0x00 TTL=107 ID=32007 PROTO=UDP SPT=22352 DPT=1024 LEN=28 

Searching hasn't turned up anything useful, except udp port 1024 is a reserved port, it might be a worm, or it might be P2P related.

I have Transmission (bittorrent client) running too, downloading and seeding a few things - could it be related to that?

Update 1: Output of sudo netstat -panu: Nothing listening on udp 1024

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
udp        0      0 0.0.0.0:53              0.0.0.0:*                           1058/dnsmasq    
udp        0      0 0.0.0.0:67              0.0.0.0:*                           1058/dnsmasq    
udp        0      0 0.0.0.0:111             0.0.0.0:*                           657/rpcbind     
udp        0      0 192.168.0.255:137       0.0.0.0:*                           947/nmbd        
udp        0      0 192.168.0.1:137         0.0.0.0:*                           947/nmbd        
udp        0      0 0.0.0.0:137             0.0.0.0:*                           947/nmbd        
udp        0      0 192.168.0.255:138       0.0.0.0:*                           947/nmbd        
udp        0      0 192.168.0.1:138         0.0.0.0:*                           947/nmbd        
udp        0      0 0.0.0.0:138             0.0.0.0:*                           947/nmbd        
udp        0      0 192.168.0.1:51413       0.0.0.0:*                           1136/transmission-d
udp        0      0 0.0.0.0:60642           0.0.0.0:*                           1136/transmission-d
udp        0      0 0.0.0.0:48894           0.0.0.0:*                           1113/squid3     
udp        0      0 0.0.0.0:805             0.0.0.0:*                           657/rpcbind     

Update 2: My internet connection uses a dynamic IP, so I reset the modem and was assigned a new address, but the flood of connection attempts continues. It must be related to the transmission torrent daemon.

Update 3: Restarted modem again, this time with the torrent daemon stopped and the multiple connection attempts were not happening. After a few minutes I started the daemon and within seconds the incoming requests were back.

What does the torrent protocol use udp port 1024 for?

share|improve this question
    
10.1.1.3 is internal, so where is the NAT happening? Is anything listening on 10.1.1.3 port 1024 (sudo netstat -panu) –  Paul Sep 24 '12 at 6:02
    
@Paul, 10.1.1.3 is my firewall/router/server. I've updated the question to show the output of netstat. –  DrTwox Sep 24 '12 at 6:21
add comment

1 Answer

up vote 1 down vote accepted

Torrenting uses UDP (as seen in this excerpt from your firewall log):

PROTO=UDP

If you want to prove that this traffic is related to your torrenting, stop doing it. See if the traffic dies out. Turn it back on, see if traffic picks up.

Torrenting uses UDP and random ports between 1024 and 65534

In effect this is expected behavior for what you have described you are doing, I'm showing you how to prove it to yourself.

If I am wrong, this should prove that as well.

LEN=48 TOS=00 PREC=0x00 TTL=108 ID=22226 PROTO=UDP SPT=25677 DPT=1024 LEN=28

DPT= Destination port (1024) SPT=Source Port, you'll notice those vary.

share|improve this answer
    
"...random ports between 1024 and 65534." - That's what confused me - these aren't random ports trying to connect, only udp 1024. –  DrTwox Sep 24 '12 at 7:08
    
By "random port" it doesn't mean that each connection uses a random port. It means that different torrenting software may use different (random) ports. Yours uses 1024, other software may use port 4212. Or, each time the software starts up it may select a different port number to use (or may have a setting that causes this to happen). Long story short, if you disable the software and the problem goes away, you have likely proved the cause. –  Everett Sep 24 '12 at 15:24
    
I'm sorry, but I still don't understand exactly! "Yours uses 1024" I can't see that in the netstat output above, nor in any configuration file for the daemon. It certainly is the torrent daemon that causes these connection requests, you helped me see that. But how and why are these requests coming in when the daemon is not actually listening for them? Sorry if this is getting a bit off the original question! :) –  DrTwox Sep 24 '12 at 22:42
    
"What does the torrent protocol use udp port 1024 for?" I was answering this question. You said you wanted to know what your torrent software was using port 1024 for. Transferring files is the answer. –  Everett Sep 26 '12 at 5:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.