Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ok so i am the admin of a small network with a web server and only the web server has a direct connection to the internet, the rest of the network are connecting through another place. I was inspecting the traffic on the server with tcpdump, and i found a LOT of connections from different IP addresses to port 6881. All ports on my machine are blocked except those who are really needed for a web server (like port 80), so i checked it out and confirmed that 6881 and the rest ports are in filtered(firewalled) state.

Why all those ips are continuously trying to make connection to the server on port 6881 no matter it's not open at all ? Is this some new kind of attack or maybe there's some new exploit (maybe 0day?) for some service running on 6881 ? AFAIK on 6881 operate the bittorrent and similar, so really, what's the deal ? It would be nice if someone clarifies me some things.

share|improve this question
Anyone on the network using bittorrent(or steam,wow, or similar) ? bt clients advertise what they think is their external ip to trackers, and some clients just never give up connecting back – nos May 10 '10 at 18:19

Use Wireshark (or similar) and have a look at what the traffic is, rather than just looking at what port it's for. That may give you a clue. Port 6881 is most likely bittorrent traffic but may also be the result of malware. Check your internal traffic as well, looking for signs of bittorrent traffic.

share|improve this answer

Sounds like someone is spoofing your address and then talking to a tracker, probably due to ignorance rather than malice. Assuming it isn't killing your connection, I'd see if it persists more than a day or so, and if it does then talk to your provider to see if they can filter it on their end.

share|improve this answer

yeah its probably a dns change for a tracker gone bad. If you have a real internet connection(business service) they should be able to filter it out for you.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.