[olug] Varying port access from an internal XP box

[Eric P]

Eric P wrote:
> Eric P wrote:
>> Hi,
>>
>> I flipped on Firestarter (Linux GUI firewall) and noticed the XP box on my network is trying to access some service on
>> my Linux box (the one w/Firestarter) about four times every minute.   With Firestarter it's being blocked now, but the
>> troubling thing is the port changes w/each request, and they're high non-standard ports in the 33,000-61,000 range.
>>
>> Any ideas or should I begin suspecting a virus on the XP box?
>>
>> Thanks,
>> Eric P.
>>
> 
> I should add that the only service I knowingly use between the machines is Samba for accessing the XP files from the
> Linux box.
> 
> Thanks,
> Eric P.
> 

Ok, my last email lead me to a possible answer.

It seemed that FuseSmb was trying to verify a connection it had with a pre-established mount point on the XP box.  Since
it could no longer access the XP file share (due to turning on Firestarter which was now blocking it), FuseSmb tried to
periodically access the XP file share but Firestarter wouldn't allow a response back.  So my guess is FuseSmb kept
telling the response to try different ports on each intermittent check since it never heard anything back.

At least that's my best guess.

Eric P.