Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been watching my logs (Ubuntu 9.10 server) and dunno about any of you but I am getting a ton of traffic from sources like Russia, Romania, etc.. on port 11370 (my iptables are logndrop'ing it. But was just curious).

Some googling revealed this info:
http://www.keysigning.org/sks/ -which seems to use port 11370 & 11371

Could that be the service they are scanning for (i don't run it)?

ICS shows this: https://isc.incidents.org/port.html?port=11370

Just curious what you guys think and if anyone has seen this before? If need be I can post my log on here, but its just a dropped log of TCP port 11370 from various IPs.

Thought it was strange as thats the ONLY Port I seem to repeatedly be hit on (from logs).

I'm running on a Linode (VPS) if that matters to annyone.

share|improve this question
    
I have to say I'm pretty impressed you actually read your firewall logs. I don't. –  Chris S Mar 20 '10 at 2:27

2 Answers 2

up vote 2 down vote accepted

Open (socat -v tcp-l:11370,reuseaddr -) this port and watch what goes to it

Alternatively, redirect the traffic somewhere to analyse using iptables.

/* Note: comments and votes were for other, shorter formulation */

share|improve this answer
2  
Negative captain. Tcpdump would be able to see that traffic even without allowing it in iptables. –  EEAA Mar 20 '10 at 1:25
    
Probably it will be TCP SYNs. I thought he wants to know what service is trying to be accessed. How tcpdump can show the data if connection fails? No connection => no data. The way without allowing actual connection may be setting up iptables to REDIRECT to some controlled port or DNAT to some other IP which will anonyse the data. –  Vi. Mar 20 '10 at 3:51
    
Vi, I believe you're confused. Tcpdump can show any IP packet that hits the network interface card. A successful TCP handshake is not needed. –  EEAA Mar 20 '10 at 4:43
1  
I think Vi's point is that some data won't be sent until a connection is established. Take for example an HTTP request - if you have port 80 blocked, you will never be able to see what it's requesting because the request isn't made until the connection is opened. –  Nic Mar 20 '10 at 4:58
    
@ErikA Is the actual data that is transmitted by TCP seen in the that packets? I see things like "GET / HTTP/1.1" in the third packet (first is SYN, second is ACK). If connection is rejected or filtered, I can't see what actual data would have been transmitted if the connection were established. –  Vi. Mar 20 '10 at 5:04

Maybe this is some new zeroday exploit on a service that runs on that, or a some kind of backdoor rat. checkout http://www.dshield.org/trends.html. Consider offering your firewall logs to them.

If you on your server an want to check if a process is listening on that port just do

netstat -l -p -d | grep 11370

also if you see unknown port numbers doing

cat /etc/services | grep 11370

come up blank on my machine.

I think (if it's still available) tcpview.exe on windows to do the same job.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.