Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game. |
Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
 |
09-24-2005, 10:50 PM
|
#1
|
Member
Registered: May 2003
Location: PA
Posts: 82
Rep:
|
Look at all this ssh traffic!
Recently I set up a linux router which sits inbetween my internet router and my pc. Anyway, I always ssh into this linux router, RH 9, and lately tethereal has been showing millions of packets like so:
5.050038 10.51.1.123 -> 10.51.1.1 TCP 1068 > ssh [ACK] Seq=0 Ack=73152 Win=62800 Len=0
5.059895 10.51.1.1 -> 10.51.1.123 SSH Encrypted response packet len=188
5.069873 10.51.1.1 -> 10.51.1.123 SSH Encrypted response packet len=100
5.070035 10.51.1.123 -> 10.51.1.1 TCP 1068 > ssh [ACK] Seq=0 Ack=73440 Win=64240 Len=0
5.079893 10.51.1.1 -> 10.51.1.123 SSH Encrypted response packet len=188
5.089871 10.51.1.1 -> 10.51.1.123 SSH Encrypted response packet len=100
5.090031 10.51.1.123 -> 10.51.1.1 TCP 1068 > ssh [ACK] Seq=0 Ack=73728 Win=63952 Len=0
5.099893 10.51.1.1 -> 10.51.1.123 SSH Encrypted response packet len=188
5.109874 10.51.1.1 -> 10.51.1.123 SSH Encrypted response packet len=100
5.110017 10.51.1.123 -> 10.51.1.1 TCP 1068 > ssh [ACK] Seq=0 Ack=74016 Win=63664 Len=0
5.119895 10.51.1.1 -> 10.51.1.123 SSH Encrypted response packet len=188
Does anyone have any idea why this could be happening? No pub key or RSA logins are enabled on sshd, just password. Any advice would be much appreciated.
Cheers.
Stakhous
|
|
|
09-24-2005, 11:50 PM
|
#2
|
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
|
Maybe I'm missing something, but were you logged into server over ssh at the time?
|
|
|
09-25-2005, 03:15 PM
|
#3
|
Member
Registered: May 2003
Location: PA
Posts: 82
Original Poster
Rep:
|
Yes I was, and this traffic only happens when I'm logged in through ssh. Sorry, I should have mentioned this before.
|
|
|
09-25-2005, 07:14 PM
|
#4
|
Member
Registered: May 2003
Location: PA
Posts: 82
Original Poster
Rep:
|
A friend mentioned it being a botmaster. Anyone know anything about this?
|
|
|
09-25-2005, 10:55 PM
|
#5
|
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
|
If you SSH'd into the server and ran ethereal, you'd expect to see lots of SSH traffic (i.e. you'd be seeing your own traffic). What in particular is making you think something is abnormal?
|
|
|
09-26-2005, 12:24 AM
|
#6
|
Member
Registered: May 2003
Location: PA
Posts: 82
Original Poster
Rep:
|
I ssh into the linux machine, I then leave it go and that sits idle. I check the packets transferred out/in on the ssh client machine and it looks like this:
Transferred OUT: 3,165,100,230
Transferred IN : 118,000
Transferred OUT increments about 20-30 packets a second. This is only when Im sshed into the linux machine.
Seems like an a lot of uneeded traffic generated by ssh. No programs on the sshd server are supposed to be talking to programs on the ssh client.
Let me know if you need any more info.
|
|
|
09-26-2005, 01:23 AM
|
#7
|
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
|
I think what you're seeing is just the tethereal traffic being transmitted to you over the ssh link. So when tethereal detects a ssh packet, it dumps a line of output to the terminal, which in this case is the ssh connection. The server then transmits that output over ssh to the remote ssh client. That outgoing packet is then detected by tethereal which repeats the whole process over and over again. Try running tethereal so that it dumps to a file instead of stdout (you'll also need to suppress the counter). So do something like this:
Code:
First test to see how long it takes to capture 100 packets:
tethereal -c 100 port 22
Then send output to file and suppress packet counter:
tethereal -q -c 100 -w testfile port 22
If takes awhile to fill, then you can be pretty sure it's just tethereal detecting it's own traffic.
Last edited by Capt_Caveman; 09-26-2005 at 01:29 AM.
|
|
|
All times are GMT -5. The time now is 08:55 PM.
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
Latest Threads
LQ News
|
|