0

We recently received a notice from our Server-providers that they detected an outgoing port-scan from our Server. They checked for malware or compromised account, but didn't find any. All they have suggested is to add IpTables rule for outgoing TCP connections for 80 & 443.

But I would like to know what went wrong. Nothing in /var/log/auth.log. I have fail2ban also installed. Any ideas what I should do. Thanks a lot. :-)

Update

tcpdump on range 4000-8000.

tcpdump portrange 4000-8000
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
14:06:45.025204 IP pacific1660.serverprofi24.eu.5142 > static.126.53.251.148.clients.your-server.de.sip: SIP, length: 417
14:06:45.154178 IP pacific1660.serverprofi24.eu.5142 > legion04.delink-server.net.sip: SIP, length: 419
14:06:45.201135 IP pacific1660.serverprofi24.eu.5142 > static.158.53.251.148.clients.your-server.de.sip: SIP, length: 419
14:16:52.536090 IP 5.45.64.228.7835 > static.158.53.251.148.clients.your-server.de.https: Flags [S], seq 1603658319, win 29200, options [mss 1460], length 0
14:22:13.722644 IP scan-11d.shadowserver.org.45417 > legion04.delink-server.net.6379: Flags [S], seq 1826412023, win 65535, length 0
14:22:13.722660 IP legion04.delink-server.net.6379 > scan-11d.shadowserver.org.45417: Flags [R.], seq 0, ack 1826412024, win 0, length 0

Is the seq number used by shadowserver.org as high as 1826412023 normal? As I checked their site, they are for fighting cyber-crime.

7
  • Is your server a single machine or it's a router with a LAN (or several of them) behind it? To rephrase, does it provide Internet access to other machines?
    – kostix
    Jan 19, 2016 at 17:26
  • All-in-all, you supposedly have something compromised. For instance, if you have websites running, it's possible that you have some of them owned, so the malware is run by some of your webservers. You can try figuring out where the traffic comes from by running running properly instrumented tcpdump.
    – kostix
    Jan 19, 2016 at 17:28
  • Get the details from your provider. Port scan detection is notorious for false positives.
    – Ron Trunk
    Jan 20, 2016 at 2:11
  • @kostix : Sorry for the late reply. Yes, it provides internet-access to another machines and its a dedicated server.. How can I go about analysing with tcpdump? Jan 20, 2016 at 9:34
  • @RonTrunk : The provider sent us a complete list of source and destination IP(same addreses), with different ports. Jan 20, 2016 at 9:35

1 Answer 1

1

Do you run an FTP server? If so, the "portscan" could very well have been just a busy FTP session in "active mode" (which causes the server to make TCP connections to ports selected by the client). While FTP was widely used, this was probably the single most common cause of false portscan detections.

If not, please expand your question and include some details of the portscan. For example, what destination ports were tested? Were the connection attempts successful?

Also, if you provide Internet access to other machines, the portscan (if it was a real portscan) may have originated on one of those.

Instead of (or in addition to) using tcpdump, I'd recommend running a netflow collector (like nfdump) on the internal interface (the one that faces the computers you provide Internet connectivity to). NetFlow data is a lot more succinct than a tcpdump pcap file, making finding portscans in it easier.

2
  • Thank you for the detailed answer. I made a mistake while understanding if our server provides internet connectivity to others, and no, it doesn't. Secondly, I will get the log of port-scanning by tomorrow, and then I will update the post with it. But as of now, I am running a tcpdump on ports 4000-8000. I have updated the result in main-post, and mainly concerned about the shadowserver.org log which is shown. Can you kindly have a look. Thank you. :-) Jan 21, 2016 at 13:27
  • Large sequence numbers are normal (the initial sequence number is a random large integer). The log doesn't appear to show a portscan. Jan 21, 2016 at 17:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .