Since the past few days, I noticed that my router was a bit slow, and was restarting by itself at times. When looked at it's logs, they had entries like:
Friday Jul 13 13:09:02 2012 1 Blocked by DoS protection 59.145.XX.XX
I thought I was being bombarded by packets from the specified IP, and contacted the owners, only to get told that the router was instead preventing a machine from within my network from spamming the said IP.
Eventually, I narrowed the bad traffic down to my MBP. i.e. I'd occasionally get those entries in my router when my MBP was connected, but not for any of the other machines. To find out what was causing the issue, I installed Private Eye, but that didn't flag anything.
Finally I ran Wireshark, and saw that something was constantly sending out a lot of packets to seemingly random IPs. There was a bit of a pattern in the order of packets though.
- My machine would send an ICMP packet to a remote IP.
- That IP would then get back to my machine with a TCP SYN, attempting to connect to 30149 (could've been randomly chosen, but this port no. didn't change for over 5 hours that I was monitoring it).
- My machine would respond back with an [RST, ACK], probably since there was nothing listening at that port, thus terminating the connection.
- There was also a UDP packet to the same port (30149) in between.
- I remember seeing a BitTorrent connection (as identified by Wireshark) in addition to all these for some IP, but that was a one-off instance (a single packet, maybe), and I couldn't quite make sense of the data.
I've seen a few other posts where people have complained about strange traffic, and the answer usually is that it's just some idle traffic from the machine. But this definitely doesn't look like idle traffic. This sequence of packets is being sent constantly. Actually, these steps keep happening in parallel for multiple IPs (but their relative order seems to be preserved). So, there's quite a bit of traffic. When I look at the Activity Monitor, the traffic seems to be a steady 5-6 KB/s, which isn't a lot, except that it's spam.
I'm trying to narrow all this down to a single process (or a set of them), which'd hopefully help me make better sense of the situation. I haven't been successful so far though.
'lsof -i :30149' didn't help, since there's nothing listening there.
I've installed Little Snitch, but haven't got around to trying it (waiting for a virus scan to complete to restart the machine and finish it's installation). I'm not quite hopeful of it identifying the culprit though, considering Private Eye didn't identify anything.
So, does anyone have any suggestions as to how I can figure out the process that's generating this traffic? Has anyone seen similar traffic? Any help is appreciated.
-- EDIT --
Ran Little Snitch, but that didn't turn up anything. i.e. When I run Wireshark, there's still the same strange traffic. But Little Snitch doesn't prompt me about those connections, possibly because no connections are established. So, I still have no clue as to which process is generating this traffic.
-- UPDATE --
I had the steps wrong. The sequence starts with an external IP trying to send a packet to my TCP/UDP port 30149, which is refused by my machine. In case of TCP, it turns out to be an [RST, ACK]. And in case of UDP, it seems to send back an ICMP error message (never knew an ICMP message would be sent back in response to an UDP error). Here's a screencap of the Wireshark capture, filtered to one of the IPs:
Here's another screencap, showing typical network activity:
192.168.2.5 is the MBP.
So, me trying to narrow it down to a local process was the wrong idea, since all these are inbound connections.
Strangely, I see this traffic only on my broadband connection. When I capture while connected through my datacard (with wifi turned off, which's usually connected to the broadband connection), none of this traffic is seen. So, it looks like all these IPs are trying to hit my public IP (broadband), which gets assigned to me dynamically (but it still stays the same for over a month). Maybe the previous owner of the IP was infected, and this is just a result of that. Not sure. I still don't understand why this traffic shows up only on the MBP. It didn't show up when I set up a capture on other (Windows) machines.
At this point, I'm utterly confused, and I'm sorry if all this looks a bit nonsensical. I know I should rephrase/rewrite the question. I'll get to that later.