☰

MacOS X：日誌中充滿了來自 LAN 路由器的“隱形模式連線嘗試”

tag-icon • tag-icon macos firewall
MacOS X：日誌中充滿了來自 LAN 路由器的“隱形模式連線嘗試”

MacOS X 的日誌檔案daily.log充滿了這樣的行：

Sun Jan 29 09:51:47 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:51855 from 192.168.2.1:53<br/>
Sun Jan 29 10:00:22 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:49972 from 192.168.2.1:53<br/>
Sun Jan 29 10:01:46 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:52317 from 192.168.2.1:53<br/>
Sun Jan 29 10:11:49 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:65055 from 192.168.2.1:53<br/>
Sun Jan 29 10:13:14 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:65439 from 192.168.2.1:53<br/>
Sun Jan 29 10:22:24 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:61231 from 192.168.2.1:53<br/>
Sun Jan 29 10:22:31 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:65419 from 192.168.2.1:53<br/>
Sun Jan 29 10:41:04 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:59362 from 192.168.2.1:53<br/>
Sun Jan 29 10:41:38 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:49793 from 192.168.2.1:53<br/>
Sun Jan 29 10:41:48 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:64922 from 192.168.2.1:53<br/>
Sun Jan 29 10:42:19 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:62376 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:09 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:53441 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:26 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:64847 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:31 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:59459 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:34 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:50163 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:34 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:51454 from 192.168.2.1:53<br/>
Sun Jan 29 10:47:34 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:56510 from 192.168.2.1:53<br/>
Sun Jan 29 10:52:38 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:59546 from 192.168.2.1:53<br/>
Sun Jan 29 10:52:38 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:62730 from 192.168.2.1:53<br/>
Sun Jan 29 10:52:46 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:58754 from 192.168.2.1:53<br/>
Sun Jan 29 10:52:48 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:64268 from 192.168.2.1:53<br/>
Sun Jan 29 11:24:08 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:59974 from 192.168.2.1:53<br/>
Sun Jan 29 11:41:20 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:65478 from 192.168.2.1:53<br/>
Sun Jan 29 11:41:24 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:52758 from 192.168.2.1:53<br/>
Sun Jan 29 11:41:25 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:64679 from 192.168.2.1:53<br/>
Sun Jan 29 11:41:59 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:63220 from 192.168.2.1:53<br/>
Sun Jan 29 12:11:59 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:58767 from 192.168.2.1:53<br/>
Sun Jan 29 13:07:56 nameofmymac Firewall[77] <Info>: Stealth Mode connection attempt to UDP 192.168.2.49:55906 from 192.168.2.1:53<br/>

這是值得擔心的事嗎？

  • 在 MacOS X 10.6.8 上。

  • 192.168.2.1是我的路由器的LAN IP，192.168.2.49是我的Mac的IP。

  • 它也很快填滿了我的日誌文件daily.log，該文件的大小已經達到 2.7 GB！ （有沒有辦法禁止日誌檔案中不斷產生新行？）

  • 我讀了連接埠 2703 出現奇怪的攻擊但這似乎是另一回事。

答案1

你不用擔心。

隱身模式使您的機器忽略（而不是拒絕）從外部發起的連線（例如連接埠掃描）；就好像該特定 IP 位址根本沒有任何電腦一樣。

一般來說，隱身模式條目可能是一個問題，但這些條目來自路由器的 DNS 連接埠 (192.168.2.1:53)。最有可能發生的情況是，您的電腦向路由器發送 DNS 請求，但回應返回速度比預期慢，防火牆認為這是從外部發起的不同連線。您的電腦和路由器之間的連線不太可能很慢，很可能是您正在使用的外部 DNS 伺服器（您的 ISP 或 OpenDNS 或公共 DNS 服務之一）回應速度較慢。

我還沒有找到一種方法可以在不關閉隱身模式的情況下僅停止來自 DNS 伺服器的日誌條目。

答案2

不，這不是同一件事。如另一個答案所述，它是對來自 DNS 伺服器的 DNS 查詢的答案。

Terry Lambert 對 MacOS 防火牆有一些不太恭維的話要說，但讀起來很有趣。誤導可憐的新手管理員，讓他們認為存在諸如 UDP/IP「連接」之類的東西，這顯然不是它唯一的愚蠢缺陷。

進一步閱讀

相關內容