1

I have a what I believe is a clean CentOS 7 system set up and wanted to see the network traffic so I installed NetHogs. I was surprised to see random connections come up, mostly to the Asian Pacific RIPE network. However, I am also seeing connections to here in the states and central america.

NetHogs version 0.8.2-SNAPSHOT

PID USER     PROGRAM                                   DEV        SENT      RECEIVED       
1421 tnsun    sshd: tnsun@pts/0                        enp0s3     0.568   0.064 KB/sec
  ? root     xxx.xxx.xxx.xxx:1433-156.3.174.102:56800             0.000   0.000 KB/sec
  ? root     xxx.xxx.xxx.xxx:3306-123.249.45.210:46686            0.000   0.000 KB/sec
  ? root     xxx.xxx.xxx.xxx:111-66.240.236.119:11748             0.000   0.000 KB/sec
  ? root     xxx.xxx.xxx.xxx:23-191.109.233.156:56641             0.000   0.000 KB/sec
  ? root     unknown TCP                                          0.000   0.000 KB/sec

TOTAL                                                             0.568       0.064 KB/sec 

I figured I had been hacked and since this server has not gone live yet I decided the easiest thing to do is just create another VM.

Starting from scratch I installed the minimal CentOS 7 and got networking up. I immediately disabled root ssh logins did yum update and installed iptables blocking nearly everything.

I then installed vim and out of curiosity installed NetHogs again. This required the EPEL Repo but I need it for other things so I enabled it.

Running NetHogs shows me that even on a VM that is less than 30 min old on a new IP address that has not been used, the system is still making connections to unknown hosts.

Could something I've installed be compromised? Everything I've installed came from the default repos except for NetHogs which came from the EPEL repo.

2
  • If you at least showed the actual IP addresses, some minor investigation would be possible. That said, the fact that no data is sent or received is not that worrisome, although a tiny bit intriguing. Jul 31, 2016 at 1:09
  • Those look like database ports of MySQL and mssql. Did you check the checksum of the installation media to confirm that it is valid?
    – yetdot
    Jul 31, 2016 at 1:19

1 Answer 1

1

I figured it out.

  • I was under the false impression that these were outgoing connections because of the order of the IP's. Apparently the local IP is always first regardless of who initiated the connection.
  • I also assumed that iptables blocked everything that is not allowed. It makes sense. The system has to at least get the header info to see if it should be blocked.

These are just systems probing for open ports. I'm not hacked. :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .