I have never installed any sort of file sharing program on my computer. I'm worried that someone may have been able to sneak something in now. My firewall logs are filling up with tons of hits to this port. I found this forum after doing some investigation on the port.

Do people randomly look for these gnutella clients?
Would so many hits from one address indicate that my machine is "advertising" that it's a gnutella client? If so, is there a way I can find out which client was installed or is there a way I can shut off the advertising?

are you using a dynamic IP address?

Yes
PPPoE

It is possible, but unlikely. What you're experiencing on your firewall log is probably "internet noise." I use Zone Alarm Pro intermittently, although never when I run a Gnutella client, and I receive message after message that an external source is attemtping to access my system. But when I track the captured IP numbers, they seem to occur in a random pattern. I've never noticed any differences between enabling or disabling my firewall. I haven't experienced any invasions. The entries in your log are probably harmless. In addition, however, I run all the scans in Norton SystemWorks regularly, so the chances of someone changing my configuration because they were able to access my system is fairly remote. Not impossible, but remote.
But I would exercise some caution in choosing a file sharing client. Many of the commercial programs available contain hidden spyware, load uninvited software on your system and pester you with annoying ads. Gnutella is mostly commerical free. BearShare will install spyware, but you are given the option to decline. Stay away from SwapNut, one client that should be excluded from this site. With those exceptions, load a Gnutella client and enjoy yourself. Presently, I have installed eight Gnutella programs and haven't encountered any problems.

Oh, I forgot to add...I also scan frequently with Ad-aware, a program that detects and can remove spyware and other uninvited software from your hard drive. It's a free download from lavasoft.

Since you have a dynamic IP it's likely whoever had the address before you was running a gnutella application of some type. What you're seeing are other peers attempting to connect to it (thinking the it may still be running). It's generally harmless (probably wouldn't even be noticed except for your firewall logs). It should go away if you log off and grab a different IP.

So, your current IP is eighter in a host cache or in the resume/hostlist of another client. Whoever had your IP before run a gnutella client, no need to worry. I see the same incoming traffic, I'm using pppoe with DSL. Having a working packetfilter/firewall is allways a good idea.

You can find more details in this thread:
http://gnutellaforums.com/showthread...light=incoming

Thanks for all the feedback. I appreciate it.

-MadAxe