Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was playing with my new syslog server and had my m0n0wall firewall logs forwarded as a test, I noticed a bunch of recent firewall log entries that say that it blocked other WAN IPs from my ISP (I checked) from connecting to me on TCP port 445. Why would a random computer be trying to connect to me on a port apparently used for Windows SMB shares? Just internet garbage? A port scan?

Here is what I am seeing:

Mar 15 23:38:41 gateway/gateway ipmon[121]: 23:38:40.614422 fxp0 @0:19 b 98.82.198.238,60653 -> 98.103.xxx.xxx,445 PR tcp len 20 48 -S IN broadcast
Mar 15 23:38:42 gateway/gateway ipmon[121]: 23:38:41.665571 fxp0 @0:19 b 98.82.198.238,60665 -> 98.103.xxx.xxx,445 PR tcp len 20 48 -S IN
Mar 15 23:38:43 gateway/gateway ipmon[121]: 23:38:43.165622 fxp0 @0:19 b 98.82.198.238,60670 -> 98.103.xxx.xxx,445 PR tcp len 20 48 -S IN broadcast
Mar 15 23:38:44 gateway/gateway ipmon[121]: 23:38:43.614524 fxp0 @0:19 b 98.82.198.238,60653 -> 98.103.xxx.xxx,445 PR tcp len 20 48 -S IN broadcast
Mar 15 23:38:44 gateway/gateway ipmon[121]: 23:38:43.808856 fxp0 @0:19 b 98.82.198.238,60665 -> 98.103.xxx.xxx,445 PR tcp len 20 48 -S IN
Mar 15 23:38:44 gateway/gateway ipmon[121]: 23:38:43.836313 fxp0 @0:19 b 98.82.198.238,60670 -> 98.103.xxx,xxx,445 PR tcp len 20 48 -S IN broadcast
Mar 15 23:38:48 gateway/gateway ipmon[121]: 23:38:48.305633 fxp0 @0:19 b 98.103.22.25 -> 98.103.xxx.xxx PR icmp len 20 92 icmp echo/0 IN broadcast
Mar 15 23:38:48 gateway/gateway ipmon[121]: 23:38:48.490778 fxp0 @0:19 b 98.103.22.25 -> 98.103.xxx.xxx PR icmp len 20 92 icmp echo/0 IN
Mar 15 23:38:48 gateway/gateway ipmon[121]: 23:38:48.550230 fxp0 @0:19 b 98.103.22.25 -> 98.103.xxx.xxx PR icmp len 20 92 icmp echo/0 IN broadcast
Mar 15 23:43:33 gateway/gateway ipmon[121]: 23:43:33.185836 fxp0 @0:19 b 98.86.34.225,64060 -> 98.103.xxx.xxx,445 PR tcp len 20 48 -S IN broadcast
Mar 15 23:43:34 gateway/gateway ipmon[121]: 23:43:33.405137 fxp0 @0:19 b 98.86.34.225,64081 -> 98.103.xxx.xxx,445 PR tcp len 20 48 -S IN
Mar 15 23:43:34 gateway/gateway ipmon[121]: 23:43:33.454384 fxp0 @0:19 b 98.86.34.225,64089 -> 98.103.xxx.xxx,445 PR tcp len 20 48 -S IN broadcast

I blacked out part of my IP address for my own safety.

share|improve this question
    
As to why that port: linklogger.com/TCP445Scan3.htm –  user53747 Mar 16 '11 at 4:23
add comment

2 Answers

up vote 4 down vote accepted

There are lots and lots of robots (worms or viruses on infected machines, scanning bots running on compromised machines, etc) out there on the 'net looking for SMB servers that are vulnerable to security bugs or are exporting world-accessible shares. You're seeing the "ambient background noise" of that scanning traffic in your firewall logs.

It's nothing to be alarmed about. Just block the traffic and move on (like you are doing w/ your firewall). It's a fact of life on the Internet today.

share|improve this answer
    
I see so just random sweeps for possible holes, good to know. –  Solignis Mar 15 '11 at 23:58
    
I feel sorry for all the people that do open SMB to the world, bad idea... –  Solignis Mar 15 '11 at 23:58
    
@Solignis: You can see a lot of interesting things about these kinds of attacks with honeypots. An associate of mine runs an SSH honeypot and the transcripts of sessions he gets out of it are comedy gold. He also gathers a large number of exploit code samples by running various other types of honeypots that emulate vulnerable services. –  Evan Anderson Mar 16 '11 at 0:00
    
Wow that is a great idea when properly secured, I am sure he learns a lot from what he sees. –  Solignis Mar 16 '11 at 0:03
    
@Solignis: The server software he's using is very "armored" against attack and he's not using any "real" server software to run the honeypot (i.e. the SSH server isn't a really SSH server-- it's a Python script running as an unprivileged user listening on a high port with connections redirected via iptables from port 22, etc). I tell you, the SSH transcripts are comedy gold! >smile< –  Evan Anderson Mar 16 '11 at 0:07
add comment

The Internet is a jungle, and you can get eaten. These attempts are most likely random, sweeping segments of networks looking for open ports and then vulnerabilities to exploit. Your firewall is doing it's job. Take care you don't NAT ALL inbound ports to a server, just the ones you need, then protect the applications listening on those ports and keep them up to date.

share|improve this answer
    
Us new fish never get to answer anything first :) –  SpacemanSpiff Mar 15 '11 at 23:56
1  
Yeah I always a little paranoid about opening ports, for example NO SSH directly to the internet, I use a VPN. –  Solignis Mar 15 '11 at 23:57
    
@solignis thats a smart procedure to follow also. –  Jacob Mar 16 '11 at 0:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.