I use a modem connection, which usually lasts few minutes, and of course, on different IP numbers each time. However, these days I'm observing an unusual number of failed attempts to enter my PC (what for, I wonder?). Usually they go to port 137 (Netbios), some to ident, but recently I'm seeing attempts to port 5327 from different hosts. What the h**k is port 5327 used for? It is not listed in /etc/services. Usually, the firewall reject them, but you can see in the log below it accepted some packets (although there was no response, according to iptraf), and that worries me a little. Why some times the firewall accepts them, and some times reject them? (that's the OT question O:-) by the way) Dec 4 21:37:57 nimrodel ip-up.local: --> Up ppp0 /dev/ttyS1 115200 Local: 213.99.178.120 Remote: 193.152.21.236 Par: (it took less than 10 seconds after connection went up to start!) Dec 4 21:38:06 nimrodel kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=193.152.43.8 DST=213.99.178.120 LEN=44 TOS=0x00 PREC=0x00 TTL=252 ID=51122 DF PROTO=TCP SPT=42574 DPT=5327 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B4) Dec 4 21:38:06 nimrodel kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=193.152.43.8 DST=213.99.178.120 LEN=44 TOS=0x00 PREC=0x00 TTL=252 ID=51122 DF PROTO=TCP SPT=42574 DPT=5327 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B4) Dec 4 21:38:30 nimrodel kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=193.152.43.8 DST=213.99.178.120 LEN=44 TOS=0x00 PREC=0x00 TTL=252 ID=51123 DF PROTO=TCP SPT=42574 DPT=5327 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B4) Dec 4 21:38:30 nimrodel kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=193.152.43.8 DST=213.99.178.120 LEN=44 TOS=0x00 PREC=0x00 TTL=252 ID=51123 DF PROTO=TCP SPT=42574 DPT=5327 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B4) Dec 4 21:39:23 nimrodel kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=193.152.43.8 DST=213.99.178.120 LEN=44 TOS=0x00 PREC=0x00 TTL=252 ID=5369 DF PROTO=TCP SPT=42574 DPT=5327 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B4) Dec 4 21:39:23 nimrodel kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=193.152.43.8 DST=213.99.178.120 LEN=44 TOS=0x00 PREC=0x00 TTL=252 ID=5369 DF PROTO=TCP SPT=42574 DPT=5327 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B4) Dec 4 21:40:15 nimrodel kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=193.152.43.8 DST=213.99.178.120 LEN=44 TOS=0x00 PREC=0x00 TTL=252 ID=61619 DF PROTO=TCP SPT=42574 DPT=5327 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B4) Dec 4 21:40:15 nimrodel kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=193.152.43.8 DST=213.99.178.120 LEN=44 TOS=0x00 PREC=0x00 TTL=252 ID=61619 DF PROTO=TCP SPT=42574 DPT=5327 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B4) Dec 4 21:40:24 nimrodel kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=210.65.61.71 DST=213.99.178.120 LEN=78 TOS=0x00 PREC=0x00 TTL=110 ID=18190 PROTO=UDP SPT=1031 DPT=137 LEN=58 Dec 4 21:42:12 nimrodel kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=67.25.69.234 DST=213.99.178.120 LEN=78 TOS=0x00 PREC=0x00 TTL=111 ID=28602 PROTO=UDP SPT=1028 DPT=137 LEN=58 -- Cheers, Carlos Robinson