On 14 April 2010 23:15, Srdjan Todorovic todorovic.s@googlemail.com wrote:
21:14:22.990731 IP dataman1.home.net.53662 > 229.185.249.62.customer.cdi.no.3625: UDP, length 33
I think I might have hit one reference to Toredo (UDP tunnel broker) for one of the ports in your logs.
"The 53662 port was being used for Teredo tunneling when this scan was performed." www.symantec.com/avcenter/reference/ATR-VistaAttackSurface.pdf
Not sure if that's relevant though.
Srdjan