Established and unreplied tcp-connections from/to unknown networks

Ygrex · 08-03-2009, 05:33 AM

Hi,

Once I've revisioned a connection tracking list on my linux-driven router/nat, an odd thing has been revealed. The list contains large amount of entries with both src's and dst's from networks, which I do not know. I am 100% sure, that these networks are not routed with my devices. All such entries are ESTABLISHED TCP and UNREPLIED.

How could they appear in the connection tracking list?

Thanks for any help,

Igor

Suncoast · 08-04-2009, 05:35 PM

Could be just hacker probes. Which tcp ports are being opened?

Ygrex · 08-06-2009, 03:16 AM

mostly 80 was in use; I cannot figure out the way, how such connections could be established

Suncoast · 08-06-2009, 09:44 AM

You did not post much information about your network. I can only assume they are NAT translations for the websites you are visiting. This would also include all the banner ad sites on those web pages. If you did a Google search and looked at 10 results, you would see over 100 unique connections. And those sites do not always close their connections gracefully, so they may be listed for hours.

Ygrex · 08-07-2009, 08:01 AM

Quote:

Originally Posted by Suncoast

I can only assume they are NAT translations for the websites you are visiting.

I do NAT only of Private IP addresses

Quote:

Originally Posted by Suncoast

If you did a Google search and looked at 10 results, you would see over 100 unique connections. And those sites do not always close their connections gracefully, so they may be listed for hours.

but either DST or SRC field will be filled with my IP (or IP of my NAT-gateway, if I am behind NAT)

or is there missed anything?

Suncoast · 08-07-2009, 02:45 PM

Could you post a sample of what you are seeing?

Click here to use Steve Gibson's "Shields Up" site to test your IP address. It's possible your NAT is being misused by someone. Not likely though.

Ygrex · 08-08-2009, 03:40 AM

Quote:

Originally Posted by Suncoast

Could you post a sample of what you are seeing?

No problem, the following line I've found in /proc/net/ip_conntrack on one of my NATs:

Code:

tcp      6 307131 ESTABLISHED
        src=83.136.240.102 dst=121.23.0.100 sport=25 dport=17728
        packets=3 bytes=570 [UNREPLIED]
        src=121.23.0.100 dst=83.136.240.102 sport=17728 dport=25
        packets=0 bytes=0 mark=0 use=1

Neither SRC nor DST address are from my networks.

Quote:

Originally Posted by Suncoast

Click here to use Steve Gibson's "Shields Up" site to test your IP address. It's possible your NAT is being misused by someone. Not likely though.

Thank you, I'll try it on monday.

Suncoast · 08-08-2009, 08:16 AM

Interesting. The sample you posted is port 25, which is Email. Do you know subnets? Are either of those IP addresses (SRC/DST) on the same subnet as you are? Is the host portion of either of those IP address the same as yours? The only thing I can think of is someone on the same subnet is spoofing addresses.

Do the command "arp -a"

Code:

steve@O:~$ /sbin/arp -a
qbooks.local.loc (192.168.24.126) at 00:04:5a:0f:f4:0a [ether] on eth0
? (192.168.24.65) at 00:11:21:04:4e:e0 [ether] on eth0
? (152.178.14.96) at 00:11:21:04:4e:e0 [ether] on eth0
( IP Addresses fictional )

The output shows IP address and MAC address. In this example, notice the 2nd and 3rd IP address have the same MAC address. That means one of two things. The MAC address is a router or Gateway. Or that person is spoofing another address.

Arp tables do not stay long. You may need to run this command over time to catch a duplicate MAC.

And just to be thorough, do a "route" command. Check to be sure none of those subnets are in your routing table.

Suncoast · 08-11-2009, 05:51 PM

Did you get a chance to try it?

Ygrex · 08-12-2009, 01:19 PM

It seems, that the GRC's scanner gives no more information, than nmap does. It hasn't helped.

Well, I've checked ARP-table and found no suspicious entries.

Hence I guess alien traffic could appear from optical fibers, which we rent.

Suncoast · 08-16-2009, 04:49 PM

I didn't realize you had access to the public side of your NAT device. So yes, nmap would be about the same. It sounds like you are happy with what you've found.