up vote 1 down vote favorite
share [g+] share [fb]

I've been watching my logs (Ubuntu 9.10 server) and dunno about any of you but I am getting a ton of traffic from sources like Russia, Romania, etc.. on port 11370 (my iptables are logndrop'ing it. But was just curious).

Some googling revealed this info:
http://www.keysigning.org/sks/ -which seems to use port 11370 & 11371

Could that be the service they are scanning for (i don't run it)?

ICS shows this: https://isc.incidents.org/port.html?port=11370

Just curious what you guys think and if anyone has seen this before? If need be I can post my log on here, but its just a dropped log of TCP port 11370 from various IPs.

Thought it was strange as thats the ONLY Port I seem to repeatedly be hit on (from logs).

I'm running on a Linode (VPS) if that matters to annyone.

link|improve this question
100% accept rate
I have to say I'm pretty impressed you actually read your firewall logs. I don't. – Chris S♦ Mar 20 '10 at 2:27
feedback

2 Answers

up vote 2 down vote accepted

Open (socat -v tcp-l:11370,reuseaddr -) this port and watch what goes to it

Alternatively, redirect the traffic somewhere to analyse using iptables.

/* Note: comments and votes were for other, shorter formulation */

link|improve this answer
2  
Negative captain. Tcpdump would be able to see that traffic even without allowing it in iptables. – ErikA Mar 20 '10 at 1:25
Probably it will be TCP SYNs. I thought he wants to know what service is trying to be accessed. How tcpdump can show the data if connection fails? No connection => no data. The way without allowing actual connection may be setting up iptables to REDIRECT to some controlled port or DNAT to some other IP which will anonyse the data. – Vi. Mar 20 '10 at 3:51
Vi, I believe you're confused. Tcpdump can show any IP packet that hits the network interface card. A successful TCP handshake is not needed. – ErikA Mar 20 '10 at 4:43
1  
I think Vi's point is that some data won't be sent until a connection is established. Take for example an HTTP request - if you have port 80 blocked, you will never be able to see what it's requesting because the request isn't made until the connection is opened. – Nic Mar 20 '10 at 4:58
@ErikA Is the actual data that is transmitted by TCP seen in the that packets? I see things like "GET / HTTP/1.1" in the third packet (first is SYN, second is ACK). If connection is rejected or filtered, I can't see what actual data would have been transmitted if the connection were established. – Vi. Mar 20 '10 at 5:04
show 1 more comment
feedback
up vote 0 down vote

Maybe this is some new zeroday exploit on a service that runs on that, or a some kind of backdoor rat. checkout http://www.dshield.org/trends.html. Consider offering your firewall logs to them.

If you on your server an want to check if a process is listening on that port just do

netstat -l -p -d | grep 11370

also if you see unknown port numbers doing

cat /etc/services | grep 11370

come up blank on my machine.

I think (if it's still available) tcpview.exe on windows to do the same job.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.