Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have connections like this showing frequently in iftop:

12.15.127.75.host.nwnx.net => 121.61.153.172 480b 160b 40b

I have no idea what it is or where it's come from. A netstat -a shows:

udp        0      0 12.15.127.75:netbios-ns *:*
udp        0      0 12.15.127.75:netbios-ns *:*

At the moment I've thinking I've probably been hacked, but does anyone have a clever way of investigating things like this?

** EDIT **

I have had a look at it with a packet sniffer (tcpdump), searching for the I.P connecting in of 124.134.97.173

124.134.97.173.1317 > 12.15.127.75.host.nwnx.net.ms-sql-s: Flags [S], cksum 0xb2af (correct), seq 1417033873, win 65535, options [mss 1440,nop,nop,sackOK], length 0
12.15.127.75.host.nwnx.net.ms-sql-s > 124.134.97.173.1317: Flags [R.], cksum 0xdf4b (correct), seq 0, ack 1417033874, win 0, length 0

Transmission Control Protocol, Src Port: ms-sql-s (1433), Dst Port: vrts-ipcserver (1317), Seq: 1, Ack: 1, Len: 0
Source port: ms-sql-s (1433)
Destination port: vrts-ipcserver (1317)

Still don't really know what to make of it though

Thanks

share|improve this question
    
I recommend a packet capture on the connecting IP . –  jeffatrackaid Mar 27 '13 at 19:56
    
Thanks, I have done so (see above) –  rastaboym Mar 27 '13 at 21:47
add comment

1 Answer

Just looking at the provided info, which is not much, I would say a Veritas software is communicating with a Ms-SQL database over the network. vrts-ipcserver stands for one of the admin services for a Veritas installation.

You can find info regarding Veritas ports in here: http://h30499.www3.hp.com/t5/System-Administration/Ports-used-by-Veritas-admin-tools/td-p/3164261

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.