4

Been looking in my iptables logs and there are hundreds of different IP's trying to access port 45702, Google doesn't seem to know much.

They always arrive in blocks per ip

 Jun 3 00:59:49 76.108.181.238  32253   in  130.88.149.86   45702   UDP
 Jun 3 00:59:42 76.108.181.238  32253   in  130.88.149.86   45702   UDP
 Jun 3 00:59:39 76.108.181.238  32253   in  130.88.149.86   45702   UDP
 Jun 3 00:59:38 76.108.181.238  32253   in  130.88.149.86   45702   UDP
 Jun 3 00:54:35 76.108.181.238  32253   in  130.88.149.86   45702   UDP
 Jun 3 00:54:33 76.108.181.238  32253   in  130.88.149.86   45702   UDP
 Jun 3 00:54:31 76.108.181.238  32253   in  130.88.149.86   45702   UDP
 Jun 3 00:52:39 76.108.181.238  32253   in  130.88.149.86   45702   UDP
 Jun 3 00:52:33 76.108.181.238  32253   in  130.88.149.86   45702   UDP
 Jun 3 00:52:30 76.108.181.238  32253   in  130.88.149.86   45702   UDP
 Jun 3 00:52:29 76.108.181.238  32253   in  130.88.149.86   45702   UDP

Does anyone know what this is/have any advice apart from ensuring it is closed?

If it's a useless port, why are all these IP's visiting it?

Edit:

Now it's suddenly changed to another port, still lots of different ip's

Jun 3 02:02:19  157.157.153.131 62411   in  130.88.149.86   47515   TCP
 Jun 3 02:02:11 157.157.153.131 62411   in  130.88.149.86   47515   TCP
 Jun 3 02:02:07 157.157.153.131 62411   in  130.88.149.86   47515   TCP
 Jun 3 02:02:05 157.157.153.131 62411   in  130.88.149.86   47515   TCP
 Jun 3 02:02:04 157.157.153.131 62411   in  130.88.149.86   47515   TCP
 Jun 3 02:02:02 157.157.153.131 62411   in  130.88.149.86   47515   TCP
 Jun 3 02:02:03 157.157.153.131 62411   in  130.88.149.86   47515   TCP
 Jun 3 02:02:01 157.157.153.131 62411   in  130.88.149.86   47515   TCP
 Jun 3 02:02:00 157.157.153.131 62411   in  130.88.149.86   47515   TCP
 Jun 3 01:52:52 194.144.100.212 50879   in  130.88.149.86   47515   TCP
 Jun 3 01:52:44 194.144.100.212 50879   in  130.88.149.86   47515   TCP
 Jun 3 01:52:38 194.144.100.212 50879   in  130.88.149.86   47515   TCP
 Jun 3 01:52:40 194.144.100.212 50879   in  130.88.149.86   47515   TCP
Jun 3 02:27:06  157.157.153.131 53228   in  130.88.149.86   47515   TCP
 Jun 3 02:27:05 157.157.153.131 53228   in  130.88.149.86   47515   TCP
 Jun 3 02:27:04 157.157.153.131 53228   in  130.88.149.86   47515   TCP
 Jun 3 02:27:03 157.157.153.131 53228   in  130.88.149.86   47515   TCP
 Jun 3 02:17:05 194.144.100.212 60288   in  130.88.149.86   47515   TCP
 Jun 3 02:16:57 194.144.100.212 60288   in  130.88.149.86   47515   TCP
 Jun 3 02:16:53 194.144.100.212 60288   in  130.88.149.86   47515   TCP
 Jun 3 02:16:51 194.144.100.212 60288   in  130.88.149.86   47515   TCP

I am confuzzled, but I guess it's being caught so doesn't matter,

The thing I don't understand is why there are lots of different ip's trying the same thing, I guess someone is using proxies to change IP every few mins and really loves ports above 45000 (because lots of critical services are run there?!?).

Improve this question
3
  • 1
    As you've pointed out, it doesn't appear to be a very popular port. If you're bored, you set up a dummy netcat - listen in, and see what data it throws your way. Guessing it's some new malware, but that's just a guess :) Good luck.
    – khosrow
    Jun 3, 2011 at 1:11
  • Instead of netcat, it would be interesting to run wireshark on that box and see what is actually running. Wireshark can decode the packets into at least what they are. If it's something more ongoing a NID/PS is probably the way to go. You're not specifying whether this is a server or a router, or something in between, but even wireshark or a NID/PS running on a mirror port would yield a lot more information than netcat. It may also reveal the originating conversation that could have started on a lower, more common port.
    – Steve Butler
    Feb 12, 2014 at 5:23
  • The port is most likely random. It could be a continuation of an existing conversation ala passive ftp (jscape.com/blog/bid/80512/Active-v-s-Passive-FTP-Simplified) The initial conversation may be on a lower, known, port, and then jump up to random for the actual transfer of data.
    – Steve Butler
    Feb 12, 2014 at 5:28

1 Answer 1

Reset to default
3

It is common for bittorrent clients to use ports that high. If someone on the network is using such a client configured that way then the incoming connection attempts could be other clients trying to talk to it. It could also be that there is a remotely exploitable bug in a common client (I've not heard of one, but that doesn't mean several don't exist) then the traffic could be a bit trying to hunt out running copies of that client to try exploit.

By my understanding it seems odd that such connections would come in blocks from the same source on the same port via TCP if the connections are bittorrent related, though it is less odd for UDP (multiple initial packets could be sent out in case the earlier ones were lost due to a temporary glitch if your firewall silently drops packets rather than sending out an error response).

In any case using netcat to see what comes in as Xerxes suggests will give you some clues unless the traffic it for a properly encrypted protocol (even then there could be clues in the opening handshake attempt).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .