Ok so i am the admin of a small network with a web server and only the web server has a direct connection to the internet, the rest of the network are connecting through another place. I was inspecting the traffic on the server with tcpdump, and i found a LOT of connections from different IP addresses to port 6881. All ports on my machine are blocked except those who are really needed for a web server (like port 80), so i checked it out and confirmed that 6881 and the rest ports are in filtered(firewalled) state.
Why all those ips are continuously trying to make connection to the server on port 6881 no matter it's not open at all ? Is this some new kind of attack or maybe there's some new exploit (maybe 0day?) for some service running on 6881 ? AFAIK on 6881 operate the bittorrent and similar, so really, what's the deal ? It would be nice if someone clarifies me some things.
