Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was toying with iftop on my VPS, and I discovered that half of my connections were between my port 9001 and "Tor domains":

* :9001 <=> psilotorlu.torservers.net:34599 0b 80b 20b
* :9001 <=> static.8.58.4.46.clients.your-server.de:48073 0b 80b 20b
* :9001 <=> 63-234-226-151.dia.static.qwest.net:33004 400b 80b 20b
* :9001 <=> tor20.anonymizer.ccc.de:56704 400b 80b 20b
* :9001 <=> 180.149.96.69:33778 0b 80b 20b
* :9001 <=> de.gigabit.perfect-privacy.com:40113 0b 80b 20b
* :9001 <=> thoreau.guilhem.org:24841 0b 74b 18b
* :9001 <=> torrouter.ucar.edu:36461 0b 0b 21b
* :9001 <=> tor-exit1.conformal.com:6911 0b 0b 21b
* :9001 <=> tor19.anonymizer.ccc.de:60907 0b 0b 20b
* :9001 <=> torsrv3.snydernet.net:36088 0b 0b 20b
* :9001 <=> flow.bsdunix.ch:33751 0b 0b 20b
* :9001 <=> tor-exit.krikkit.nl:59192 0b 0b 20b
* :9001 <=> exit-01a.noisetor.net:10236 0b 0b 20b
* :9001 <=> tor-exit.krikkit.nl:45189 0b 0b 20b
* :9001 <=> hosted-by.scopehosts.com:50534 0b 0b 20b
* :9001 <=> c-71-195-56-37.hsd1.mn.comcast.net:40962 0b 0b 20b
* :9001 <=> warsaw.corvidworks.net:56570 0b 0b 20b
* :9001 <=> exit-01b.noisetor.net:16914 0b 0b 20b
* :9001 <=> psilotorlu.torservers.net:37969 0b 0b 20b
* :9001 <=> 204.45.139.123:48042 0b 0b 20b
* :9001 <=> psilotorlu.torservers.net:52856 0b 0b 20b
* :9001 <=> 208.68.37.153:55550 0b 0b 20b
* :9001 <=> tor-exit-router40-readme.formlessnetworking.net:40933 0b 0b 18b

Following the advice I found on the net, I ran lsof -i :9001, but this didn't yield any processes. Let me add this is a fairly fresh install with LAMP on Ubuntu 12.10, with SSH keys, denyhosts, fail2ban (currently disabled)... I'm lost! Here is ps -efl (excluding bash and screen):

F S UID        PID  PPID  C PRI  NI ADDR SZ WCHAN  STIME TTY          TIME CMD
4 S root         1     0  0  80   0 -   869 poll_s Jan27 ?        00:00:00 /sbin/init
1 S root         2     0  0  80   0 -     0 kthrea Jan27 ?        00:00:00 [kthreadd]
1 S root         3     2  0  80   0 -     0 run_ks Jan27 ?        00:00:02 [ksoftirqd/0]
5 S root         5     2  0  80   0 -     0 worker Jan27 ?        00:00:00 [kworker/u:0]
1 S root         6     2  0 -40   - -     0 cpu_st Jan27 ?        00:00:00 [migration/0]
1 S root         7     2  0 -40   - -     0 watchd Jan27 ?        00:00:01 [watchdog/0]
1 S root         8     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [cpuset]
1 S root         9     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [khelper]
5 S root        10     2  0  80   0 -     0 devtmp Jan27 ?        00:00:00 [kdevtmpfs]
1 S root        11     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [netns]
1 S root        12     2  0  80   0 -     0 bdi_sy Jan27 ?        00:00:00 [sync_supers]
1 S root        13     2  0  80   0 -     0 bdi_fo Jan27 ?        00:00:00 [bdi-default]
1 S root        14     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [kintegrityd]
1 S root        15     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [kblockd]
1 S root        16     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [ata_sff]
1 S root        17     2  0  80   0 -     0 hub_th Jan27 ?        00:00:00 [khubd]
1 S root        18     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [md]
1 S root        21     2  0  80   0 -     0 watchd Jan27 ?        00:00:00 [khungtaskd]
1 S root        22     2  0  80   0 -     0 kswapd Jan27 ?        00:00:00 [kswapd0]
1 S root        23     2  0  85   5 -     0 ksm_sc Jan27 ?        00:00:00 [ksmd]
1 S root        24     2  0  80   0 -     0 fsnoti Jan27 ?        00:00:00 [fsnotify_mark]
1 S root        25     2  0  80   0 -     0 ecrypt Jan27 ?        00:00:00 [ecryptfs-kthrea]
1 S root        26     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [crypto]
1 S root        35     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [kthrotld]
1 S root        37     2  0  80   0 -     0 worker Jan27 ?        00:00:00 [kworker/u:2]
1 S root        38     2  0  80   0 -     0 scsi_e Jan27 ?        00:00:00 [scsi_eh_0]
1 S root        39     2  0  80   0 -     0 scsi_e Jan27 ?        00:00:00 [scsi_eh_1]
1 S root        41     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [binder]
1 S root        61     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [deferwq]
1 S root        62     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [charger_manager]
1 S root        63     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [devfreq_wq]
1 S root       224     2  0  80   0 -     0 kjourn Jan27 ?        00:00:02 [jbd2/sda-8]
1 S root       225     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [ext4-dio-unwrit]
1 S root       307     1  0  80   0 -   705 poll_s Jan27 ?        00:00:00 upstart-udev-bridge --daemon
5 S root       309     1  0  80   0 -   729 epoll_ Jan27 ?        00:00:00 /sbin/udevd --daemon
5 S 102        386     1  0  80   0 -   845 epoll_ Jan27 ?        00:00:00 dbus-daemon --system --fork
5 S syslog     392     1  0  80   0 -  7544 poll_s Jan27 ?        00:00:11 rsyslogd -c5
1 S root       417     2  0  60 -20 -     0 rescue Jan27 ?        00:00:00 [kpsmoused]
1 S root       685     1  0  80   0 -   704 poll_s Jan27 ?        00:00:00 upstart-socket-bridge --daemon
4 S root       694     1  0  80   0 -  1158 n_tty_ Jan27 tty4     00:00:00 /sbin/getty -8 38400 tty4
4 S root       696     1  0  80   0 -  1158 n_tty_ Jan27 tty5     00:00:00 /sbin/getty -8 38400 tty5
4 S root       707     1  0  80   0 -  1158 n_tty_ Jan27 tty2     00:00:00 /sbin/getty -8 38400 tty2
4 S root       708     1  0  80   0 -  1158 n_tty_ Jan27 tty3     00:00:00 /sbin/getty -8 38400 tty3
4 S root       714     1  0  80   0 -  1158 n_tty_ Jan27 tty6     00:00:00 /sbin/getty -8 38400 tty6
1 S root       723     1  0  80   0 -   544 poll_s Jan27 ?        00:00:00 acpid -c /etc/acpi/events -s /var/run/acpid.socket
1 S root       724     1  0  80   0 -   655 hrtime Jan27 ?        00:00:00 cron
1 S daemon     727     1  0  80   0 -   619 hrtime Jan27 ?        00:00:00 atd
4 S root       887     1  0  80   0 -  1158 n_tty_ Jan27 tty1     00:00:00 /sbin/getty -8 38400 tty1
1 S root      1766     2  0  80   0 -     0 bdi_wr Jan28 ?        00:00:00 [flush-8:0]
4 S root      1770     1  0  80   0 -  7294 poll_s Jan28 ?        00:00:00 /usr/sbin/console-kit-daemon --no-daemon
4 S root      1939     1  0  80   0 -  1673 poll_s Jan28 ?        00:00:00 /usr/sbin/sshd -D
5 S root      5438   309  0  80   0 -   728 epoll_ Jan28 ?        00:00:00 /sbin/udevd --daemon
5 S root      5469     1  0  80   0 -  3449 poll_s Jan28 ?        00:00:01 python /usr/sbin/denyhosts --daemon --purge --config=/etc/denyhosts.conf
4 S mysql     6997     1  0  80   0 - 81909 poll_s Jan28 ?        00:01:27 /usr/sbin/mysqld
1 S root     13281     1  0  80   0 -   595 hrtime Jan28 ?        00:00:10 /usr/sbin/vnstatd -d
1 S root     13497     1  0  80   0 -  8786 poll_s Jan28 ?        00:06:43 mosh-server new -s -c 0
0 S root     13585 13565  0  80   0 -  3578 poll_s Jan28 pts/2    00:00:03 dvtm
0 S root     13636 13620  0  80   0 -  4690 n_tty_ Jan28 pts/7    00:00:00 mysql
0 S root     16567 13609  0  80   0 -  1183 wait   21:40 pts/6    00:00:00 man iftop
0 S root     16576 16567  0  80   0 -  1115 n_tty_ 21:40 pts/6    00:00:00 pager -s
4 S root     16583 13587  0  80   0 -  8597 poll_s 21:43 pts/4    00:00:01 iftop
1 S root     16609     2  0  80   0 -     0 worker 22:04 ?        00:00:00 [kworker/0:0]
1 S root     16617     2  0  80   0 -     0 worker 22:09 ?        00:00:00 [kworker/0:2]
1 S root     16627     2  0  80   0 -     0 worker 22:14 ?        00:00:00 [kworker/0:1]

Any help will be appreciated. Thanks!

Edit: As there are no replies, just in case somebody else has an issue like this with a VPS, monitor a bit if it's a brand new VPS, with a fresh IP address. It may very well be, as David commented below, that this IP used to host a Tor server. In fact, the Apache logs show attempts to GET /tor.

share|improve this question

closed as too localized by Michael Hampton, mdpc, Khaled, Scott Pack, Ward Feb 3 '13 at 6:32

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Run netstat -tnlp | grep -w 9001 –  Michael Hampton Jan 29 '13 at 22:35
    
Hi Michael, thanks for your feedback. Just as with lsof, I get nothing. –  eze Jan 29 '13 at 22:59
2  
That's not good. It sounds like you might have something hidden on your machine. See if anything is listening on port 9001. You can try telnet <machines_IP> 9001 on another machine. –  David Schwartz Jan 29 '13 at 23:00
    
Thanks, David. This time I get telnet: Unable to connect to remote host: Connection refused. –  eze Jan 29 '13 at 23:07
2  
@eze: That's a good sign. Maybe people are just trying to connect to your IP because it was previously assigned to a Tor server? Do a tcpdump -p 9001 and see what the traffic looks like. –  David Schwartz Jan 29 '13 at 23:14
show 1 more comment