Ridiculous amount of blocked inbound connections

[Guest]

[2point0]

Hello all!  First off I am new to Comodo and I love it and I am very excited to be a part of this community.

Well, as I am sure you can guess by the subject, I am getting an absurd amount of inbound connections but I have no idea what the cause of this is.  I am getting approximately 50+ inbound policy violations and I can't figure out the source.

Any help would be greatly appreciated.

Here is a sample so you can see the frequency of the connection attempts.

Date/Time :2006-09-21 01:04:41
Severity :Medium
Reporter :Network Monitor
Description: Inbound Policy Violation (Access Denied, IP = *.*.*.*, Port = 6881)
Protocol: UDP Incoming
Source: *.*.*.*:3000
Destination: *.*.*.*:6881
Reason: Network Control Rule ID = 5


Date/Time :2006-09-21 01:04:41
Severity :Medium
Reporter :Network Monitor
Description: Inbound Policy Violation (Access Denied, IP = *.*.*.*, Port = 6881)
Protocol: UDP Incoming
Source: *.*.*.*:49153
Destination: *.*.*.*:6881
Reason: Network Control Rule ID = 5


Date/Time :2006-09-21 01:04:36
Severity :Medium
Reporter :Network Monitor
Description: Inbound Policy Violation (Access Denied, IP = *.*.*.*, Port = 6881)
Protocol: UDP Incoming
Source: *.*.*.*:24851
Destination: *.*.*.*.116:6881
Reason: Network Control Rule ID = 5


Date/Time :2006-09-21 01:04:31
Severity :Medium
Reporter :Network Monitor
Description: Inbound Policy Violation (Access Denied, IP = *.*.*.*, Port = 6881)
Protocol: UDP Incoming
Source: *.*.*.*:6669
Destination: *.*.*.*:6881
Reason: Network Control Rule ID = 5


Date/Time :2006-09-21 01:04:31
Severity :Medium
Reporter :Network Monitor
Description: Inbound Policy Violation (Access Denied, IP = *.*.*.*, Port = 6881)
Protocol: UDP Incoming
Source: *.*.*.*:58000
Destination: *.*.*.*:6881
Reason: Network Control Rule ID = 5


Date/Time :2006-09-21 01:04:31
Severity :Medium
Reporter :Network Monitor
Description: Inbound Policy Violation (Access Denied, IP = *.*.*.*, Port = 6881)
Protocol: UDP Incoming
Source: *.*.*.*:32100
Destination: *.*.*.*:6881
Reason: Network Control Rule ID = 5

Edit: Sorry for putting this in FAQs

[Soy Joy]

Hi, welcome to the forum.
Glad to have you as a part of this community.

...in the mean time, can you please attach a screenshoot to your "Network Control Rules", as it seems all of this LOG trigered by your rule in position #5.

Also, can you tell us what's your OS, CPF version, other security software you use, etc.

[2point0]

I'll get on that right now and be back in a moment to edit this post. =D

Here's the screenshot of the rules you requested, and I think I am beginning to see my problem...


I'm running Windows XP, SP2 and as far as other security software just Avast!.

[Soy Joy]

From the attached screenshoot, I can see that nothing's wrong with your rules. As it was the default one that comes with the installation.
Anyway, after doing some Googling, I found out that most Torrent downloader using this port (6881) as their default port.
...now, is there any chance that you have a torrent downloader at the moment?
If you say, yes. Then the problem should be; "How can I allow this trafic (if you want it to) then?"
It's almost as simple as 1, 2, 3. But to make you have a better understanding to how CPF work it's way around to control your trafic, you can try to check the folowing links:
-. [Emule and bittorent tuttorials]
-. [How To - Understanding & Creating Network Control Rules properly]

[2point0]

I found the same thing too shortly after I made that post.  I do use the bit torrent network for file transfers, however, currently, I am not running the program.  Why would there still be incoming connections if the program isnt open or running at all?

[Soy Joy]

Since torrent downloading are based on the tracker, then it must be the tracker that kept on trying to connect to your PC as per user request, regarding any files you seed.
And so far, as I Google around, I can say that it's quite safe to use this port, as there is none (yet!?) exploit to this torrent port.
Aside from that, you can always tone down the way CPF alerts you, by changing a few of it's configuration from the folowing order:
- Main Window > Security tab > Advanced > Miscellaneous > Alert Fequency Level

[kail]

Edit: Sorry for putting this in FAQs

No problem. I'm going to move this topic to the Help section directly after this post.

[2point0]

Thanks a lot for all your help, both for moving the topic and taking the time to answer my question(s).  This seems like a great community and I hope to be able to contribute as time goes on.

[Soy Joy]

Hey, no problem at all.
I'm just trying to raise my post count.
...but that's a secret. And don't tell everyone about it!

[Tags:]