Massive firewall hits

[deftech]

Ok whats with all these hits from a router I have plugged into the same hub as the external nic in my wingate machine? They show up all at the same time.

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:33754 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:34070 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:33603 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:33724 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:34439 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:33294 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:34611 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:34256 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:33467 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:33114 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:34253 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:33206 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:33711 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:33261 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:34052 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:33700 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:34562 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:34058 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:33214 dst 64.128.84.6:1028

03/02/06 15:51:14 Authorisation failure: NAT STATUS: firewall block: UDP src 64.128.84.7:34458 dst 64.128.84.6:1028

[genie]

Can you send the details of your networking setup on Wingate machine - internal/external markings on the adapters, IP addresses, etc.?

[deftech]

The wingate machine is a multihomed win2k box.

Two nics go to two different switches, which are not uplinked together. They represent the upstairs and downstairs of my network.

Upstairs is 10.0.0.0 255.255.255.0 range
Downstairs is 10.0.1.0 255.255.255.0 range
WAN is 64.128.xxx.xxx 255.255.255.0

About a hundred of these hits show up every 5 minutes. The hits are coming coming from a netgear router that I have plugged into the same hub as my wingate machine. The hub is uplinked to my ISP's bridge which provides us internet access.

This really isn't causing any problems, other than making me crazy that I can't figure out why they are showing up, and filling my logs up.

[Roderick]

Hi,

Can you run the command C:\WINDOWS>netstat -an in DOS prompt and see what is listening on port 1028. If you note, the des is using port 1028. Possibly there is a application running requests onto the internet but the firewall is blocking its return path.

Best regards