IP connections with 'false' IP address - daytime.exe?

[Andi B.]

My Injoy firewall constantly logs IP connections with non existent IP addresses. Moreover the false addresses changes randomly. I think I've iptraced it down once being nntp time requests. But not sure anymore.

Anyone else sees such things? Is it true that the eCS included M:\ECS\SYSTEM\TIMESET\daytime\daytime.exe is the root of such request? It is started automatically with eCS2.1DE here.

The logged IP addresses are something like -
192.30.252.129
192.168.0.1   
192.53.103.108
192.150.3.51 

My IP net is 192.168.1.x (netmask 255.255.255.0) so these IP addresses should never be routed through. Guess these are UDP packets or something else and only the firewall thinks these are IP addresses. But need help from more experienced users here. Thx.

[Ian B Manners]

Hi Andy

Just checking one of the IP's

[D:\apps\jalbum]host 192.53.103.108
108.103.53.192.in-addr.arpa domain name pointer ptbtime1.ptb.de.
looks like it probably NTP to me.

192.168.0.1 is also an internal IP address (should be non routable),
could this be your modem/router looking for NTP ?

In injoy, are you logging data for dropped/refused connections ?
or is this a normal allowed connection ?

You should be able to see daytimed.exe running if you bring up a process list.
should be a config file around somewere as well, this will likely list IP's that
daytime will try.

[Andi B.]

Thanks for your thoughts.

I see this addresses in the log of the accounting filter. Think this was a predefined Injoy filter which I enabled to see how much data my kids are downloading. We had limited data per month at the time I set up this accounting filter.

After your response I revised the Injoy filter and think I've set it wrong. In my setup I use a sever running Injoy which is the only machine connected to the ADSL router. ADSL router and one server NIC uses 10.x address range. Other NIC in server and all internal network running the 192.168.1.x net. I falsely set accounting for all 192.x packets as I thought that they are ones from my internal machines. Have to correct the filter. A lot of log entries should go then and I can concentrate on the remaining suspicious like 192.168.0.1 which should not exist on my net.

[ivan]

Another thing Andi, what does the firewall log on your router say, assuming you have activated it?  This would give much more information about what is going out - and coming in - on your network.

[Andi B.]

Ok, after a few days and correcting netmask in filter settings it works as desired. Computers are so dumb - they do what you tell them to do which is sometimes not what you really intended ;-)

Ivan - the firewall in the ADSL router is disabled as my firewall is so much more powerful and easier to set up. Moreover I trust it way more than any ADSL router. As you may have read even some of the most used and expensive routers did (does) have security problems and backdoors (Fritz box, Cisco-Linksys, ...). IMHO the best chance to shield you from burglars breaking into your network is obscurity. Good reasons to use this OS and an unusual setup and firewall.