Forum Discussion

evilpasta's avatar
evilpasta
New Contributor
8 years ago

Why is cox doing port scans?

I have noticed that Cox is regularly doing port scans, and I want them to stop. It appears the setting to block port scans in my Netgear C6300BD gateway settings are ineffective at blocking these port scans from what appears to be a Cox DNS server, cdns1.cox.net (I've seen port scans from places other than Cox IP addresses get through, too). Unfortunately, these port scans are waking up my computer, as I have the PC set to WakeonLAN with magic packet so that I can remote into my PC. It would seem these port scans are hitting a high-numbered port that I use to pass the WakeonLAN magic packet requests. The Event Viewer logs in Windows show that my PC is being woken up by my NIC at exactly the same time the Netgear logs show a port scan from a Cox IP address. I doubt I'm initiating these requests, as the PC is asleep when this happens and often so am I. Needless to say, I don't appreciate that a contact from the outside-- my own ISP-- is waking up my computer without my consent, and I want it to stop. What can I do, aside from disabling my ability to access my PC remotely?

Examples from Netgear log:

[TCP- or UDP-based Port Scan] 5 Mon Nov 27 19:41:38 2017 174.64.6.xxx:60819 68.105.28.11:53
[TCP- or UDP-based Port Scan] 4 Thu Nov 30 01:28:23 2017 174.64.6.xxx:52593 68.105.28.11:53
[TCP- or UDP-based Port Scan] 5 Sat Dec 02 02:08:20 2017 174.64.6.xxx:61791 68.105.28.11:53
[TCP- or UDP-based Port Scan] 73 Sat Dec 23 00:27:17 2017 174.64.6.xxx:35699 68.105.28.11:53
[TCP- or UDP-based Port Scan] 4 Wed Jan 03 08:14:40 2018 174.64.6.xxx:10795 68.105.28.11:53
[TCP- or UDP-based Port Scan] 2 Mon Jan 08 17:52:44 2018 174.64.6.xxx:62625 68.105.28.11:53
  • ChrisL's avatar
    ChrisL
    Former Moderator
    @evilpasta

    From the looks of what you've got posted there this appears to be DNS traffic and is being incorrectly flagged by the Netgear as a port scan. My guess would be there are other devices active on the home network using the connection.

  • evilpasta's avatar
    evilpasta
    New Contributor

    Hmm. I'm not sure this explains the correlation between this traffic and the PC's wakes from sleep. The PC should only be waking for magic packet.

  • ChrisL's avatar
    ChrisL
    Former Moderator
    @evilpasta

    If the PC is in sleep mode the DNS traffic is probably being initiated by a different device on the home network. Due to the nature of how NAT randomizes port mappings it may be triggering your WOL configuration or the issue with the PC waking is completely unrelated to this traffic. Just a quick search on my part turned up the following reference which may be helpful.

    https://www.howtogeek.com/192642/how-to-remotely-turn-on-your-pc-over-the-internet/