I ran a Wireshark packet capture on my home Windows PC, as there was some suspicion that I was infected (although I notice nothing out of the ordinary and both Avast and Malwarebytes detect nothing).

Just to be sure, I ran this capture overnight, and noticed packets from sources such as Akamai, Amazon and Microsoft (according to ARIN). Should I be worried? Here is a print screen focusing in on the dubious packet.

enter image description here

  • 2
    Those are all normal traffic. – schroeder Jul 19 '16 at 20:37
  • @schroeder (^) Thank you, but could you elaborate as to what it is? – Rohan Jhunjhunwala Jul 19 '16 at 20:47
  • 1
    Without seeing what the content is (seeing the packets) there is not much to elaborate on. It could all be normal "phone home" traffic of Windows. – schroeder Jul 19 '16 at 20:59
  • Akamai/Microsoft, pffft, it's continuous and increases mightily under Windows 8-10. What Amazon products do you have installed? – Fiasco Labs Jul 19 '16 at 22:17
  • I do not think I have any Amazon products installed. @FiascoLabs I can post the packet capture screeenshot – Rohan Jhunjhunwala Jul 19 '16 at 22:36

There are a large number of organizations, search engines, and bots which are scanning the entire Internet on a regular basis to see what ports are open and what versions of services exist. An example of a site doing this type of work is scans.io Most of this activity is not harmful.

There are even tools like masscan and Zmap which allow anyone to scan the entire IPv4 space for a given port/service in just a few minutes and you can see samples of the types of data collected at sites like scans.io

Without more information about the packets themselves it would be very hard to tell you if these were malicious in nature but most likely this is just typical Internet traffic. That said it would be wise to dig a little deeper and see if this is related to process activity on your system and see if your system, or the software on it, isn't the source for this activity.

  • Can they really scan the entire IPv4 space? I doubt it. – noɥʇʎԀʎzɐɹƆ Jul 19 '16 at 20:50
  • 3
    Absolutely. Check out the links and try it yourself. IPv4 is easy. IPv6 is hard – Trey Blalock Jul 19 '16 at 20:50
  • 1
    @uoɥʇʎPʎzɐɹC Not only can they, it's routine. Robert Graham, for one, (the creator of masscan) does it all the time for various research projects. – Xander Jul 19 '16 at 23:16
  • I feel like someone could launch a DoS attack using this - but if it hasn't been done, surely it's not possible, right? – noɥʇʎԀʎzɐɹƆ Jul 19 '16 at 23:21
  • There are better tools + you'd still need a lot of bandwidth if it's a brute-force DoS.. Not that you couldn't use it though. – Trey Blalock Jul 19 '16 at 23:22

While it is always possible that there is a malware Command and Control (C&C) server hosted on an Amazon ec2 or Microsoft cloud it is rather unlikely as such things are usually hosted on so called "Bullet Proof Hosts" that ignore take down orders. What is likely causing these requests is applications you have installed that make api calls as well as Windows looking for updates. That being said you are most likely not infected by any common large scale malware. This is not to say that you are not infected by something that was specifically targeted but if you do not have reason to suspect something like that is the case you are most likely find.


These are connections started from your Windows machine; note the SYN packet from to an external address and how your machine sends an HTTP request.

The packet you've highlighted is part of the response (503 Server Unavailable) to your HTTP query. If you right-click into it and choose "Follow TCP Stream" you'll see a reconstruction of the HTTP conversation in ASCII.

They look harmless to me and are probably part of some application (or OS component) you have installed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.