Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was doing a network scan on my computer with Wireshark and came up with something very suspicious: I found a stream with the jabber protocol. I do not have a jabber server set up nor do I have any messaging client I am using. The weird thing is that it is saying that it is to and from my website domain, which makes no sense.

I do not browse from my server and I have no idea where the traffic is coming from. I do not host my website on my computer. The only word I could make out is talk.google.com. Which I am guessing means that is the client being used. I am getting a little nervous as to what is going on here.

Here is the stream:

<stream:stream to="mywebsitesdomain.com" xml:lang="en" version="1.0" xmlns:stream="http://etherx.jabber.org/streams" xmlns="jabber:client">

<stream:stream from="mywebsitesdomain.com" id="62B02549D12F9CC2" version="1.0" xmlns:stream="http://etherx.jabber.org/streams" xmlns="jabber:client"><stream:features><starttls xmlns="urn:ietf:params:xml:ns:xmpp-tls"><required/></starttls><mechanisms xmlns="urn:ietf:params:xml:ns:xmpp-sasl"><mechanism>X-OAUTH2</mechanism><mechanism>X-GOOGLE-TOKEN</mechanism></mechanisms></stream:features><starttls xmlns="urn:ietf:params:xml:ns:xmpp-tls"/><proceed xmlns="urn:ietf:params:xml:ns:xmpp-tls"/>...........R......./.w.m..`p3WWJ....Qj..:.. R......T=..9V.
N~#.7`.......V....(.
...9.k.5.=.....#.....'.3.g.2...../.<.
...R.........talk.google.com......
.................#............
........................ ...M..R....f..f.H".$.I....K.......h4.. R...1.@,.6iJ..#.}X.2...0.n.....=...................
0...0..o......
+........z0
..*.H..
.....0F1.0...U....US1.0...U.
.
Google Inc1"0 ..U....Google Internet Authority0..
130502080651Z.
131231155850Z0i1.0...U....US1.0...U...
California1.0...U...
Mountain View1.0...U.
.
Google Inc1.0...U....talk.google.com0.."0
..*.H..
..........0..
......[...C.xlM.Z....x.i....VM....3A_.T......X..........0...hl..*.b..=....yK......HI.%7.<.."yj...D...7....jL.^...e..x...h~.lY..6...n...5..L.8".c>.JK.AR~.D...=..Y..).`.PG.$.....T.,...1.
...\1..2../6V.:...(E]...w.\...X8g..
.uTbK....[.....q...d'.kw[|o-..O`.4..............R0..N0...U.%..0...+.........+.......0...U......flA{T......
.(JM....0...U.#..0.....0..C.>g.....j..k.$0[..U...T0R0P.N.L.Jhttp://www.gstatic.com/GoogleInternetAuthority/GoogleInternetAuthority.crl0f..+........Z0X0V..+.....0..Jhttp://www.gstatic.com/GoogleInternetAuthority/GoogleInternetAuthority.crt0...U.......0.0...U....0...talk.google.com0
..*.H..
.........V..DE~..o....@.g.[)...\T..o..e......Y+S...;T.s~..-...~I.6*.D|....V._.....b;......$.Q=........2....~..K..^...]...Kb...B
..H.B.Xo....0...0...........w.0
..*.H..
.....0N1.0...U....US1.0...U.
..Equifax1-0+..U...$Equifax Secure Certificate Authority0..
121212155850Z.
131231155850Z0F1.0...U....US1.0...U.
.
Google Inc1"0 ..U....Google Internet Authority0..0
..*.H..
.........0............W..>@}....qcS..yt..D.3 ..{.(...lI~._4YN
z0....WE....s&..2.....;....6.oQD... Rs.&.5j....Y.+.g.9....l..%..3.G...Py..i.....Wo........0..0...U.#..0...H.h.+....G.# .O3....0...U........0..C.>g.....j..k.$0...U.......0.......0...U...........0:..U...3010/.-.+.)http://crl.geotrust.com/crls/secureca.crl0
..*.H..
............y.F."l.1.eC`.1P..(...f.\.5.}..NY7...&..g8Z...&2.*..xP{..~..H...>.:~.`...k...*.P.w3).@.......[.4?%..LHva......P_..d_G.......~.......................H.;...*0"...f.U.... .L....R~i...R.Y../_..:.Kt_...a.....A[C.~
....a..E j......... ?.ZQ.'g.....T.v........4wd2Iv...^.......d).......qr` ....or{.d...I........Or.@d$
.j.I.i..]...T..L~...v.9..@....H...I..s..t.H.......8q....j5.......l....jB.....;..g-.n.^...........$.qb...Rbo.x..`
.'.... ...zf..nb.ID............$..X..|..w.U...B.$&...'
I.V...7Cgs.l-.......
w.l.aS=...p.....h
.)a.r..ZX...z._..1.m.....@x.....b...X......-E.....4.].4....p....T3....0o.P....
.$]....9.........z>eXP..X.G._A..'.=t.l..q..Hqr.=.A...V.y.......g....T....~.....SA..26...VB...0.:.....*..1zpiwf.Ke'...^. .5]....OC{..p ..D)k~%b`...$.....Q....U.'....g~.V>..S=...^;x..:A.C....y....C.
.f..vrM.GC`.ded?E..b.;w7....B............$...8........(...D..}.-_a..\....v:.m..&........Q..o.[.#..I.o.&..f.t.%.....!.pEoKI...q.V.......u.o\M....c.....SIr....nY.-]..8.....MH
os'...a.;.;...U..>./FV...lQV...#d..........ux?..........b.....kIh%eX.c.jn,.&.......{oM..x......@7.w.4.......(Ky
..
...E....4j...(..)IK....| }.`....[.p8z....E....1.c...I........7.......^...n....=`.........n..?.........._.}...FO.TyJ.b.}k-......HA..,....
<'.PR..C.gZ......X4Lr2}.;........1..k%Bz{u~..<...[.Fw.....Q.D..g2d.n........../.).....Z.$...k?F.M. .[K........._!.b;.Y..q_u..\w...._{O.W.zQ..A.PG..9)..V.....g.Bn...o.L..O..TO.1].3S.a5...i`w..G'....*.....
.....4.....a#t..7..$.......$..q.F..F...cD.......q_U.....q.E.>...
z.Jv...$....:...X..m.h{....V....V
a..d..........$Qo....AP.=.........m..%......L.p..M..........8n...-..[..A.N..<.
share|improve this question
    
Are you using Gmail or Hangouts or any other Google service on your computer? –  Michael Hampton Aug 24 '13 at 0:21

1 Answer 1

Check the session data (source and destination IP address, source and destination port, volume and date&time) to find more about the traffic.

Run netstat -tunap to see which process are making established network traffic. You can then have a better idea which program made the above request.

This could also cause of GTalk widget if you are using one on your website.

share|improve this answer
    
I agree that it looks like typical google talk traffic. The OP just needs to hunt down the source of the widget. –  schroeder Aug 30 '13 at 22:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.