Lubuntu 16.04 Suspicious Traffic

robolux · 10-23-2016, 11:43 AM

Hi!

Yesterday I installed Lubuntu 16.04 to my HDD and discovered some very strange traffic both incoming and outgoing from the ntp port, listed under 123/udp.

After researching the connecting IPs I found out that most of them correspond to local software businesses and IT firms.

I checked the traffic with iftop, which showed that multiple bytes, in some cases even +1KB, was sent and received to and from those IPs.

Screenshot: https://s12.postimg.org/w647skop9/screen.png

.)Do I have to be worried, that those services transmitted malware or other harmful code?

.)How can I permanently block those connections or port?

I have tried using the following, unsuccessfully.

-->with the built in firewall

Code:

    sudo ufw deny 123/udp


    sudo ufw deny ntp

-->with iptables

Code:

    sudo iptables -A OUTPUT -p udp --dport 123 -j DROP


    sudo iptables -A INPUT -p udp --sport 123 -j DROP

Thank you!

Last edited by buntuluxx; 3 Hours Ago at 02:40 PM.

michaelk · 10-24-2016, 07:55 AM

Please post your thread in only one forum. Posting a single thread in the most relevant forum will make it easier for members to help you and will keep the discussion in one place. This thread is being closed because it is a duplicate.

Continue here:
http://www.linuxquestions.org/questi...ic-4175592039/