Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We use CSF on our server, and it automatically blocks IPs if it detects a port scan. This is the report we get when such an event occurs:

Jan 21 09:20:48 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=2 ID=55576 PROTO=UDP SPT=43731 DPT=33477 LEN=40 
Jan 21 09:20:48 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=1 ID=55572 PROTO=UDP SPT=38463 DPT=33473 LEN=40 
Jan 21 09:20:48 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=1 ID=55574 PROTO=UDP SPT=46079 DPT=33475 LEN=40 
Jan 21 09:20:48 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=3 ID=55580 PROTO=UDP SPT=35098 DPT=33481 LEN=40 
Jan 21 09:20:53 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=6 ID=55589 PROTO=UDP SPT=52047 DPT=33490 LEN=40 
Jan 21 09:20:53 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=5 ID=55585 PROTO=UDP SPT=57951 DPT=33486 LEN=40 
Jan 21 09:20:58 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=11 ID=55604 PROTO=UDP SPT=58674 DPT=33505 LEN=40 

However, in this case I am pretty sure it is not an illegal hacking attempt but this is a client of ours being blocked by the server. I now need to figure out if the server blocked this IP correctly or not. So my question is how I should interpret this? What can this log report mean, and more in general, how can I go about learning how to read those specific log entries?

Thanks!

share|improve this question
    
Is there such a thing as a legal hacking attempt? – joeqwerty Jan 21 '11 at 16:11
    
Do you recognize the source ip address as one belonging to your client? Do you recognize the destination ip address and port as belonging to a service on a server that you make available to your client? – joeqwerty Jan 21 '11 at 16:13
    
Source IP is indeed from a client. But there is no special service available to them so they should not be connecting to any odd port. (BTW how do I see to which port they are connecting from this log?) – user60129 Jan 21 '11 at 17:05
    
I'm assuming that SPT = Source Port and DPT = Destination Port. The destination ip address and port are what you should be concerned with. Is there a process/service running on those ports on the server in question? – joeqwerty Jan 21 '11 at 17:10
    
No special services are running, just Apache and a mail server. What could this be? I found this: speedguide.net/port.php?port=33473&print=friendly --- could it be they are doing a traceroute? – user60129 Jan 21 '11 at 17:32
up vote 1 down vote accepted

There are some possibilities:

  1. Your client is doing a portscan. Who knows, maybe she is using some security tool to ensure that the network is secure.

  2. Someone is misusing your client's system to do a portscan.

  3. There's a malware installed on your client's system doing a portscan.

However, since the TTL is very low, it is very probable that your client is doing a traceroute.

share|improve this answer
    
+1 for the traceroute – Antoine Benkemoun Mar 18 '11 at 14:38
    
Thanks. Is there any way I can confirm / check this to get more certainty? – user60129 Mar 26 '11 at 23:36
    
@plua the only way I can think of is to watch for traceroute pattern: repeated attempts to access a certain port, with a monotonously increasing TTL – pepoluan Mar 28 '11 at 13:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.