I have a small Ubuntu server (VPS from provider with control panel) machine for practice purposes - no production or critical stuff. I've set up ufw and nginx with a sample index.html page. I control the system through SSH, using tmux. In one of the tmux panels I have nethogs running.

Periodically, nethogs shows a connection attempt from unknown IP addresses, like this

 ?  root  45.7.xxx.xxx:23-177.238.xx.xxx:51427

My server's IP address starts with 45.7, so, is that an incoming connection? If the order of addresses was reversed, is the connection outgoing instead? The external IP addresses always are changing, also the port numbers of my machine or the external machine. No data is sent, only received, a few bytes.

As far as I know, there's no connection establishment since ufw default policy is to deny all incoming connections except for port 80 and 443. No established connections show up using netstat, except for the SSH connection.

Am I being port scanned? What can I do to avoid it?

Thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.