2

We seen suspicious probing from source port 53 to destination port 56183. May I know what services use port 56183 (udp)?

  • 6
    Are you sure that this is really probing and not just a reply of a DNS query to port 53 originating from your system? 56183 has no special meaning and is an ephemeral port, i.e. one used randomly as a source for outgoing connections. – Steffen Ullrich Mar 3 '17 at 6:30
  • Thanks Steffen, i will have to check what the source IP originates from. Will come back here to update once I have that information. – Pang Ser Lark Mar 4 '17 at 4:25
6

The range 49152–65535 (215+214 to 216−1) contains dynamic or private ports that cannot be registered with IANA.[310] This range is used for private, or customized services or temporary purposes and for automatic allocation of ephemeral ports.

Likewise, UDP 56183 does not appear on the official IANA port listing source document: http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

As Steffen Ullrich correctly points out it's most likely a DNS reply, especially given the source port, but there is a small likelihood that you are catching someone doing part of a slow but full UDP port scan of your systems. There are a few research projects like scans.io that routinely scan the entire Internet and it's not unlikely that some organization may want to collect full UDP data. That said, those scans would not be likely to use UDP/53 unless they were potentially probing firewall rules.

Do you by chance have a packet capture with more information or a source address? Sometimes that can tell you a lot more. For example, did this come from a DNS server or an IP owned by a something like a large scanning project. My guess is that Steffen Ullrich is correct and it's simply a DNS reply packet.

  • thank you. I will have to check what that source IP is. Will come back to update once I have that information. – Pang Ser Lark Mar 4 '17 at 4:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.