1

Been noticing in our firewall logs that three connections are being constantly established every 5 minutes from our web server and trying to send a packet to destination port 43 (whois port) cycling through all source ports (i.e. 59466, 59467, 59468, then 5 minutes later the next 3 ports) to 3 different ip addresses...:

193.0.6.135, 200.3.14.10, 196.216.2.130
Ripe, Lacnic, and Afrinic

I understand that all 3 companies are internet ip registrars, but how it's cycling through all of our source ports every 5 minutes sending packets seems odd. It looks like reverse port scanning to me. Is this normal?

EDIT:

TCPDUMP Output, this one was only 2 minutes apart. Noticed that there are patches where it'll run 20 times in a row within the same minute. The speed and frequency varies, but haven't seen a gap bigger than 5 minutes.

[user@xxxxxxx xxxxxxx]# tcpdump -v -s 5000 -i eth0 port 35921 or port 35920 or port 35919 or port 35916 or port 35917 or port 35918 
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 5000 bytes 
08:56:33.517976 IP (tos 0x0, ttl  64, id 8127, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35916 > whois.ripe.net.nicname: S [tcp sum ok] 2154741398:2154741398(0) win 5840 <mss 1460,sackOK,timestamp 67215657 0,nop,wscale 9> 
08:56:33.520288 IP (tos 0x0, ttl  64, id 59697, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35917 > registro.lacnic.net.nicname: S [tcp sum ok] 2139834394:2139834394(0) win 5840 <mss 1460,sackOK,timestamp 67215659 0,nop,wscale 9> 
08:56:33.522705 IP (tos 0x0, ttl  64, id 33392, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35918 > whois.afrinic.net.nicname: S [tcp sum ok] 2140808030:2140808030(0) win 5840 <mss 1460,sackOK,timestamp 67215662 0,nop,wscale 9> 
08:58:32.773110 IP (tos 0x0, ttl  64, id 28764, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35919 > whois.ripe.net.nicname: S [tcp sum ok] 2259878735:2259878735(0) win 5840 <mss 1460,sackOK,timestamp 67334931 0,nop,wscale 9> 
08:58:32.776580 IP (tos 0x0, ttl  64, id 44263, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35920 > registro.lacnic.net.nicname: S [tcp sum ok] 2259083248:2259083248(0) win 5840 <mss 1460,sackOK,timestamp 67334935 0,nop,wscale 9> 
08:58:32.778395 IP (tos 0x0, ttl  64, id 39072, offset 0, flags [DF], proto 6, length: 60) 192.168.xxx.xxx.35921 > whois.afrinic.net.nicname: S [tcp sum ok] 2267212728:2267212728(0) win 5840 <mss 1460,sackOK,timestamp 67334936 0,nop,wscale 9>
Improve this question
7
  • Now I'm wondering if I should've posted this in security or server fault...
    – Anthony Miller
    Dec 10, 2013 at 15:18
  • Have you tried looking to see what process on your web server is opening those connections?
    – longneck
    Dec 10, 2013 at 15:29
  • I can't track it with netstat/fuser as it looks as though it starts and stops too quickly. The only thing that looked connected to it was mrtg as it ran every 5 minutes in stride with the firewall logs, but disabling it proves it's innocence.
    – Anthony Miller
    Dec 10, 2013 at 16:02
  • Have a look at the -c option for netstat. Pump it to an outfile, then grep through it to find the IP addresses that are in question, then you'll find the process information if you used the correct options for netstat.
    – Wesley
    Dec 10, 2013 at 16:14
  • 1
    Those IPs are all whois servers. I'd look for a cron job running every 5 minutes that runs whois on foreign zones/IPs.
    – user143703
    Dec 10, 2013 at 17:02

2 Answers 2

Reset to default
0

The traffic itself is probably legitimate, though the running every five minutes is probably not.

This looks like standard whois traffic; it's being sent on the whois port and it's being sent to official whois servers.

However, the fact that it's happening on exact five minute intervals suggests an automated process is running the queries. The registries aren't going to like this much, and they may cut you off if it gets excessive.

You may find it useful to capture the traffic contents and inspect them to see what whois records are actually being looked up. This may give you a clue to what might be originating the queries.

If the server is running Linux, you may be able to write a systemtap script to find the process originating the queries.

(The source ports are irrelevant; that's a choice of the operating system. Go read TCP/IP Illustrated or another good IP reference if you want more details on that non-issue.)

Improve this answer
1
  • Added tcpdump output to question... I'm not sure what I'm looking at there.
    – Anthony Miller
    Dec 10, 2013 at 18:28
0

I found out on my server that the /usr/local/cpanel/scripts/update_spamassassin_config script accesses these whois servers for updating its configuration. Maybe this has to do with spamassassin in which case it is very probably legitimate.

If this is running on a server with spamassassin please check its update interval.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.