Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically:

11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=59 ID=50687 PROTO=TCP SPT=443 DPT=54102 SEQ=21105 ACK=0 WINDOW=0 RES=0x00 RST URGP=0
11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXZ DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=59 ID=50688 PROTO=TCP SPT=443 DPT=54102 SEQ=21105 ACK=0 WINDOW=0 RES=0x00 RST URGP=0
11:45:25 my.com kernel: IPTABLES: SRC=220.255.XX.XXY DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=57 ID=49686 PROTO=TCP SPT=443 DPT=54100 SEQ=21106 ACK=0 WINDOW=0 RES=0x00 RST URGP=0
11:45:26 my.com kernel: IPTABLES: SRC=220.255.XX.XXA DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=57 ID=49687 PROTO=TCP SPT=443 DPT=54100 SEQ=21106 ACK=0 WINDOW=0 RES=0x00 RST URGP=0
11:45:26 my.com kernel: IPTABLES: SRC=220.255.XX.XXB DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=59 ID=51681 PROTO=TCP SPT=443 DPT=54202 SEQ=21107 ACK=0 WINDOW=0 RES=0x00 RST URGP=0

All the source IPs are from my ISP and it appears to be running some kind of HTTPS service and trying to communicate with my computer via a high port number.

Internally, I am testing a web server and I have opened up the router to accept HTTP and HTTPS connections. I am curious what these packets from the ISP mean and whether they have any security implications.

share|improve this question
1  
It is not usual for data to be incoming from port 443. Please show more of the source IP (first three segments). –  deed02392 May 14 at 11:34
    
@deed02392, I have updated the IP. Think this is more than enough to identify the ISP. –  Question Overflow May 14 at 11:50
1  
Could this be replies to your internal host with misconfigured stateful rules by chance? It certainly looks that way. 192.168.1.1 connecting to your ISP and the return packets are being filtered maybe? –  dc5553 May 14 at 12:07
    
@dc5553, Err, but why would I want to connect to my ISP in the first place? –  Question Overflow May 14 at 12:10
    
did you try to connect to those IP addresses on 443 and see what happens? –  dc5553 May 14 at 12:15
show 1 more comment

2 Answers 2

up vote 7 down vote accepted

Which version of linux are you using and how is your iptables configure that is causing these messages to be logged?

I can offer an alternative possible explanation.

In the packets there seems to be the RST flag being set.

11:45:26 my.com kernel: IPTABLES: SRC=220.255.XX.XXA DST=192.168.1.2 LEN=40 TOS=0x00 PREC=0x00 TTL=57 ID=49687 PROTO=TCP SPT=443 DPT=54100 SEQ=21106 ACK=0 WINDOW=0 RES=0x00 RST URGP=0

This means that from 220.255 you get a RST answer back from their port 443. The increasing number of ports on your side make me assume that what you are seeing here is that the 220.255 host(s) are rejecting tcp/ip connection attempts.

Your firewall configuration is likely not relating them correctly to the syn packets you are sending out. Depending on your iptables configuration this is "normal" or the cause of a bug in older versions with the ESTABLISHED/RELATED state of connection tracking.

To investigate this further I would recommend running a tcpdump for port 443 on the respective interface and have a look if this is indeed the case, or if someone is sending unsolicited RST packets.

As a side note, I am seeing such behaviour too on some of my servers with certain ip ranges. They are all RST packets that are sent because the DNS rotation of some commonly used webservice is containing ip addresses that do not actually have a service running.

share|improve this answer
1  
Thanks for your contribution. I advise this is investigated before sending abuse notices. –  deed02392 May 14 at 13:04
    
I am using a very current version of linux. I think your explanation is quite plausible. Seeing that those pages are dishing out Google search page, it seems that those ips are being leased by my ISP to Google itself. –  Question Overflow May 14 at 13:12
    
Then it makes sense that those RST I am seeing are actually connections related to my use of Google services on whatever websites that I visit on the internet. –  Question Overflow May 14 at 13:15
add comment

It is unusual for traffic to originate from port 443. Often this is done in the hope that some misconfiguration of your firewall allows data incoming because you have opened port 443 for your own systems in both directions.

Most likely what you are seeing is an attack attempting to port scan you (presuming the destination port is trying random or consecutive ports). You should report the IP address to the authority who owns it. Do an IP-whois on it and forward logs to the abuse contact address.

share|improve this answer
    
For your first 2 sentences: it could be a much more probable hope, and this is that you allow src=443/tcp traffic, which is practically all answer for your https requests, even if it they don't have their corresponding upgoing dst=443/tcp streams. –  Peter Horvath May 14 at 12:04
    
It is very strange because I am getting source ips which varies on the last two octets. It couldn't have come from an individual. –  Question Overflow May 14 at 12:07
    
It is not impossible for a single person to control more than one IP address. You need to collect a list of the addresses and report them. –  deed02392 May 14 at 12:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.