i'm using smoothwall as my router

and in the router web interface i've found out in the firewall log page that
there is alot of blocked connections

follow are the sniped of the list of blocked connections

Code: Select all

 
Time        In        Proto      Source           Src Port   Destination        Dst Port
18:46:38     ppp0       TCP        24.226.50.254   11828      219.95.133.144      46920
18:46:41    ppp0         TCP       24.226.50.254   11828      219.95.133.144      46920
18:46:47    ppp0         TCP       24.226.50.254   11828      219.95.133.144      46920
18:46:48    ppp0       TCP      83.110.143.2   1862      219.95.133.144      4899
18:46:50    ppp0        TCP      83.110.143.2   1862      219.95.133.144      4899
18:46:53    ppp0        TCP      211.158.75.112   9194      219.95.133.144      4104
18:46:59    ppp0        TCP      24.226.50.254   11828      219.95.133.144      46920
18:47:05    ppp0        TCP       172.21.26.32   11019      219.95.133.144      41904
18:47:14    ppp0        TCP      211.74.84.140   22176      219.95.133.144      4170
18:47:20    ppp0        TCP      219.78.105.16   6881      219.95.133.144      46836
18:47:23    ppp0        TCP      24.226.50.254   11828      219.95.133.144      46920
18:47:26    ppp0        TCP      211.74.84.140   22176      219.95.133.144      4170
18:47:28    ppp0        TCP      125.64.105.63   11814      219.95.133.144      3887


some source IPs as shown above are from torrent download as i can find them in my peers list in torrent client and 219.95.133.144 is my dynamic IP assign by my ISP

my questions is why external peers would wanna connect to those unfamiliar port which is not open by smoothwall and not assign in my torrent client?

how do peers decide which port to use to make connection to another peers?

how do peers decide which port to use to make connection to another peers?

Your clients sends port number to the tracker you connect to.

These connection attempts could happen from lots of reasons, like since you have dynamic IP, maybe someone who had that address before you used some p2p program on those ports or something, maybe someone is trying to hack you...

All in all, nothing unusual.