I have a small Ubuntu server (VPS from provider with control panel) machine for practice purposes - no production or critical stuff. I've set up ufw and nginx with a sample index.html page. I control the system through SSH, using tmux. In one of the tmux panels I have nethogs running.
Periodically, nethogs shows a connection attempt from unknown IP addresses, like this
PID USER PROGRAM ? root 45.7.xxx.xxx:23-177.238.xx.xxx:51427
My server's IP address starts with 45.7, so, is that an incoming connection? If the order of addresses was reversed, is the connection outgoing instead? The external IP addresses always are changing, also the port numbers of my machine or the external machine. No data is sent, only received, a few bytes.
As far as I know, there's no connection establishment since ufw default policy is to deny all incoming connections except for port 80 and 443. No established connections show up using netstat, except for the SSH connection.
Am I being port scanned? What can I do to avoid it?