I got a suspicious link, what is it?

math_physics · 03-21-2006, 01:54 AM

I got a link from port 718 of a remote host, whose ip address is 84.56.245.11.

The link state is always "ESTABLISHED".

I tried to use iptables to disable it, but it did not work.

I used this command :
iptable -I INPUT -s 84.56.245.11 -d my-ip-address -p tcp --dport 111 -j REJECT

and command "iptable -t filter -L " gives this message:

REJECT tcp -- dslb-084-056-245-011.pools.arcor-ip.net my-ip-address tcp dpt:sunrpc reject-with icmp-port-unreachable

What is this link? How can I disable it, if it is dangerous?

Thank you very much!

math_physics · 03-21-2006, 01:55 AM

I got a link from port 718 of a remote host, whose ip address is 84.56.245.11, to my port 111 (sunrpc).

The link state is always "ESTABLISHED".

I tried to use iptables to disable it, but it did not work.

I used this command :
iptable -I INPUT -s 84.56.245.11 -d my-ip-address -p tcp --dport 111 -j REJECT

and command "iptable -t filter -L " gives this message:

REJECT tcp -- dslb-084-056-245-011.pools.arcor-ip.net my-ip-address tcp dpt:sunrpc reject-with icmp-port-unreachable

What is this link? How can I disable it, if it is dangerous?

Thank you very much!

nixcraft · 03-21-2006, 02:17 AM

Try
iptable -I INPUT -s 84.56.245.11 -j DROP

Above rule should drop any connection attempt from IP 84.56.245.11

To kill established connection use tcpkill (http://www.cyberciti.biz/howto/quest...ux-netstat.php); it is a good idea to block all incoming request

nx5000 · 03-21-2006, 02:42 AM

or if you don't manage to compile quickly enough tcpkill, you can reroute this IP to your localhost:

Code:

route add 84.56.245.11 gw 127.0.0.1

Doesn't replace iptable nor tcpkill but its a quick way to drop a connection at IP level

jschiwal · 03-21-2006, 03:03 AM

sunrpc is the port for the portmapper. This service runs if you use NFS for example.
This link may be useful.
http://probing.csx.cam.ac.uk/about/sunrpc.html

This page also links to a portmapper replacement, written by the same person to wrote postfix.
The replacement provides logging and ACLs.

If that IP address is suspect, you might consider blocking it out totally.

unSpawn · 03-21-2006, 03:45 AM

@math_physics: //Moderator.note: unfortunately you have posted two similar messages in one forum, which is against the LQ Rules. Cross-posting and posting duplicates is considered bad netiquette on your part, a waste of resources on LQ's part and a waste of time for LQ members who take the time to read and answer your question(s). Please do not do that again. Your threads have been merged for everyones convenience.

nx5000 · 03-21-2006, 03:57 AM

To see why rpc is installed, you can get the registered rpc services by doing:

Code:

rpcinfo -p localhost

Could be famd,nfs for example

If you don't need these services, remove portmap

If you don't want to export anything to the outside but still want to keep portmap running you can restrict it with tcp_wrapper. To restrict it only to localhost, you can launch portmap to listen only to localhost.

In debian (maybe others) edit /etc/init.d/portmap

Code:

OPTIONS="-i 127.0.0.1"