Question for the IT / Security geeks

[S2central.net]

I know theres a few on here so looking for some help if possible... This might be nothing or it could be nasty.

For the 1st time ever I got an email from my ISP saying that I was approaching my 10GB b/w limit for the month. I am not a big user so figured this was odd.

I did a quick network capture on this machine (Ethereal) and found lots of UDP packets coming from numerous IP hosts using port 8205. All I can find is that port 8205 is for an application called LMinstmgr - but no clue what that really is or if it is malicious.

I have ESET on here to the max and it is reporting nothing odd. The only instant messaging app I have is Skype but I have no idea why I am seeing this UDP traffic and wonder if I am being used for something.

Cheers for any insight but I will keep looking for info myself.

[Nuvo]

Port 8205 (lm-instmgr) isn't commonly used, I'm not at all sure of it's purpose but your firewall should "stealth" this, i.e., if I were to ping your ip address at this port your pc shouldn't return any packets to acknowledge its presence.

Run this little Java applet to test your ports. You can specify which ports you which to test.

[S2central.net]

There has been something going on... my firewall has been reporting attempted access on SSH as that is forwarded to one of the Macs - I have disabled that for now, but this 8205 thing is odd. I will try that java applet - thanks Nuvo.

[S2central.net]

Everything is showing 'stealth' mode... The only issue I have is that ICMP Echo is enabled - I like having the ability to ping things when travelling but as i have dynamic DNS running on the gateway its not really required. I'll turn that off - makes me harder to find by these potential bandwidth theives.

[S2central.net]

That GRC applet is now telling me this so I will keep a watchful eye after reconfiguring things ---

Your system has achieved a perfect "TruStealth" rating. Not a single packet — solicited or otherwise — was received from your system as a result of our security probing tests. Your system ignored and refused to reply to repeated Pings (ICMP Echo Requests). From the standpoint of the passing probes of any hacker, this machine does not exist on the Internet. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system wisely remained silent in every way. Very nice.

[S2central.net]

I have turned off skype now, but still getting these 8205 packets in from odd places - like users on carphone warehouse service - I must have something going on with the PC that is opening a session of some sort with those hosts. ESET isn't complaining at all.

[S2central.net]

Well - bit more diligence here now and filtered packet traces after a restart...

With skype disabled I get absolutely no traffic to/from port 8205

When I started skype, ethereal immediately caught ~500 packets to/from 8205 so that at least calms me down - there must just be occasional chatter directly between the skype clients - it looks like low bandwidth alright. Every day is a school day

Maybe I was hitting up YouTube a bit too much this month to eat most of my allowance.

[DamianURS4]

Certain products sniff 8205 because the UDP port can be a way in for viruses/ Trojans etc. However it does not mean that a virus is using port 8205, more likely that a Trojan or Virus has used this port in the past to communicate.

This is only a possibility and is indeterminate without further analysis.

[DamianURS4]

My second view would be that the Skype drivers may be a bit duff~ misconfigured configuration files can cause Registry issues which in turn can throw up port errors.............

Just my /2c :-)