0

I own a VPS running Ubuntu with Apache stuff.

Recently I am getting continous request from IP static-195.22.94.120.addr.tdcsong.se.54303 > : 12337

I already installed the 'arno-iptables-firewall'. Have iptables blocking 195.22.94.120

Still then I get the request from that IP if i see via tcpdump.

May I know what else i can do to protect my VPS? Thank you.

2 Answers 2

0

Do you have anything listening on 12337? What does netstat --inet show you? Maybe you have a rootkit or a bot installed that you don't know about? If you don't have anything listening on that port, why do you care if they're knocking on the door? If you do have something listening, figure out what it is and make sure it's something that should be there.

2
  • Thanks Paul. Actually netstat wasn't showing on 12337. :-(. The problem is my inbound bandwidth is already 86GB while my limit is only 200GB. Thats my worry. The hosting party made the server IP null route now to protect me from over usuage. Can you give some suggestions please? Thank you.
    – balajidl
    May 12, 2010 at 15:33
  • If there is nothing listening on that port, and iptables is blocking the sender, then there is nothing to protect. May 13, 2010 at 11:21
0

Just to be on the safe side, if you're running tcpdump and nothing is listening on port 12337, you should see the connection being "Reset" like so:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
23:12:41.063781 IP 1.1.1.1.57039 > 2.2.2.2.12337: S 2687592758:2687592758(0) win 65535 <mss 1452,nop,wscale 3,nop,nop,timestamp 444707996 0,sackOK,eol>
23:12:41.063805 IP 2.2.2.2.12337 > 1.1.1.1.57039: R 0:0(0) ack 2687592759 win 0

Notice on the last line: R 0:0(0), which indicates the connection was "Reset". If you see this:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
23:14:46.434607 IP 1.1.1.1.57058 > 2.2.2.2.12337: S 3988391384:3988391384(0) win 65535 <mss 1452,nop,wscale 3,nop,nop,timestamp 444709249 0,sackOK,eol>
23:14:46.434659 IP 2.2.2.2.12337 > 1.1.1.1.57058: S 1969317214:1969317214(0) ack 3988391385 win 5792 <mss 1460,sackOK,timestamp 171652775 444709249,nop,wscale 7>
23:14:46.562977 IP 1.1.1.1.57058 > 2.2.2.2.12337: . ack 1 win 65535 <nop,nop,timestamp 444709251 171652775>

In other words, Syn, Syn-ack, and an ack, it means that the remote IP made a successful connection to your system on that port. If netstat is not showing anything listening on that port, it's very likely your system was rooted and you should probably take it off the network and investigated.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .