An nslookup on the first address shows it is a system in China:
$ nslookup 61.134.84.44 8.8.8.8
Server: 8.8.8.8
Address: 8.8.8.8#53
Non-authoritative answer:
44.84.134.61.in-addr.arpa name = 44.61.134.84.net.ts.gs.dynamic.163data.com.cn.
Authoritative answers can be found from:
$
The "cn" at the end of the fully qualified domain name (FQDN) is the country code for China. And the Asia-Pacific Network Information Centre (APNIC), the regional Internet Registry (RIR) for Asia, shows the IP address 61.134.84.44 is in an address range assigned to "Tsqc internet club" in China.
An nslookup on the other address, 184.105.247.226, shows the FQDN associated with that address is scan-13h.shadowserver.org
. The Shadowserver Foundation is a "volunteer group of professional Internet security workers that gathers, tracks and reports on malware, botnet activity and computer fraud. It aims to improve the security of the Internet by raising awareness of the presence of compromised servers, malicious attackers and the spread of malware." The home page for the organization states:
Established in 2004, The Shadowserver Foundation gathers intelligence
on the darker side of the internet. We are comprised of volunteer
security professionals from around the world. Our mission is to
understand and help put a stop to high stakes cybercrime in the
information age.
As to why you might have seen network transmissions between your system and the ShadowServer system, see the organization's Open Portmapper Scanning Project page.
The other IP address in China might have been an attempt by that system to connect to your system. The Internet Storm Center, which is a program of the SANS Technology Institute that monitors the level of malicious activity on the Internet, reports recent scanning activity from the 61.134.84.44 address.
If you are connected to the Internet, you should expect frequent attempts by systems throughout the world to connect to your system as there are people throughout the world scanning the Internet for systems with vulnerabilities they can exploit; a connection attempt doesn't necessarily mean your system is vulnerable, only that someone is probing your IP address for vulnerabilities.
You could use tcpdump or Wireshark to capture and analyze the data flows to get a better idea of what is happening, i.e., is someone simply scanning your system looking for vulnerabilities or has someone compromised your system. Learning to use those tools effectively may take a fair amount of time, if you aren't familiar with Internet network protocols, but they are invaluable in troubleshooting network problems and analyzing network traffic.
Update:
The output you posted from NetHogs showed only the network ports for the other systems, i.e., 24630
for the system in China and 37393
for the Shadowserver system, but not the corresponding ports on your system, but if you want to know what process is listening on a particular port on your system, you can use the lsof command. E.g., if you wanted to know which process was listening on the standard HTTP port, which is well-known port 80, you could issue the command lsof -i TCP:80
(TCP is the protocol for HTTP while some other network protocols use UDP) or, alternatively, you could use the netstat command netstat -nlp | grep :80
. Issue the commands from the root account, i.e., either login as root and issue the command or put sudo
in front of the command depending on the distribution of Linux you are using. Refer to Finding the PID of the process using a specific port? on the Unix & Linux sister site to this site for other methods and example output.