Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We use CSF on our server, and it automatically blocks IPs if it detects a port scan. This is the report we get when such an event occurs:

Jan 21 09:20:48 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=2 ID=55576 PROTO=UDP SPT=43731 DPT=33477 LEN=40 
Jan 21 09:20:48 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=1 ID=55572 PROTO=UDP SPT=38463 DPT=33473 LEN=40 
Jan 21 09:20:48 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=1 ID=55574 PROTO=UDP SPT=46079 DPT=33475 LEN=40 
Jan 21 09:20:48 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=3 ID=55580 PROTO=UDP SPT=35098 DPT=33481 LEN=40 
Jan 21 09:20:53 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=6 ID=55589 PROTO=UDP SPT=52047 DPT=33490 LEN=40 
Jan 21 09:20:53 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=5 ID=55585 PROTO=UDP SPT=57951 DPT=33486 LEN=40 
Jan 21 09:20:58 server_name kernel: Firewall: *UDP_IN Blocked* IN=eth1 OUT= MAC=mac_id SRC=client_ip DST=server_ip LEN=60 TOS=0x00 PREC=0x00 TTL=11 ID=55604 PROTO=UDP SPT=58674 DPT=33505 LEN=40 

However, in this case I am pretty sure it is not an illegal hacking attempt but this is a client of ours being blocked by the server. I now need to figure out if the server blocked this IP correctly or not. So my question is how I should interpret this? What can this log report mean, and more in general, how can I go about learning how to read those specific log entries?

Thanks!

share|improve this question
    
Is there such a thing as a legal hacking attempt? –  joeqwerty Jan 21 '11 at 16:11
    
Do you recognize the source ip address as one belonging to your client? Do you recognize the destination ip address and port as belonging to a service on a server that you make available to your client? –  joeqwerty Jan 21 '11 at 16:13
    
Source IP is indeed from a client. But there is no special service available to them so they should not be connecting to any odd port. (BTW how do I see to which port they are connecting from this log?) –  user60129 Jan 21 '11 at 17:05
    
I'm assuming that SPT = Source Port and DPT = Destination Port. The destination ip address and port are what you should be concerned with. Is there a process/service running on those ports on the server in question? –  joeqwerty Jan 21 '11 at 17:10
    
No special services are running, just Apache and a mail server. What could this be? I found this: speedguide.net/port.php?port=33473&print=friendly --- could it be they are doing a traceroute? –  user60129 Jan 21 '11 at 17:32

1 Answer 1

up vote 1 down vote accepted

There are some possibilities:

  1. Your client is doing a portscan. Who knows, maybe she is using some security tool to ensure that the network is secure.

  2. Someone is misusing your client's system to do a portscan.

  3. There's a malware installed on your client's system doing a portscan.

However, since the TTL is very low, it is very probable that your client is doing a traceroute.

share|improve this answer
    
+1 for the traceroute –  Antoine Benkemoun Mar 18 '11 at 14:38
    
Thanks. Is there any way I can confirm / check this to get more certainty? –  user60129 Mar 26 '11 at 23:36
    
@plua the only way I can think of is to watch for traceroute pattern: repeated attempts to access a certain port, with a monotonously increasing TTL –  pepoluan Mar 28 '11 at 13:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.