0

I am having problems with somebody who has either hacked or is trying to hack into my computer.

To connect to the internet I tethered my phone to either my desktop or laptop, but internet conenctivity is terrible ( I have unlimited data).

I ran the netstat -nt and this is the output

enter image description here

Another time

enter image description here

About 30 minutes ago

enter image description here

Please view the connetions at the bottom of each screenshot, the tcp6. I believe this is the hacker/sniffer, I am unsure what is happening.

What can I do to overcome this disruption?

|improve this question
  • 1
    Why do you think this is a hacker? Just because it is IPv6? For example 2600:1406:3f:388::20 is the CDN akamai and does not look like hacking. – Steffen Ullrich Sep 19 '17 at 14:16
  • Because certain websites are blocked – IberoMedia Sep 19 '17 at 14:40
  • What do you mean by "blocked"? Does the website just not load, or is another website showing instead? Have you tried any other browsers? – MoonRunestar Sep 19 '17 at 14:50
  • 1
    @IberoMedia: Why do you think that the block is caused by a hacker? And why to you think that the IPv6 connection are the relevant part to detect the hacker? I don't see anything in your post which can only explained or even be better explained by assuming a hacker: IPv6 connections are normal today and slow internet can just be a bad connectivity, some large background job like software update or similar. Not everything which is unusual has to be a hacker. – Steffen Ullrich Sep 19 '17 at 15:18
  • I get connection time outs. I am told to check my firewall and or internet connection. The moment I connect through work's wifi, there is zero problems – IberoMedia Sep 19 '17 at 16:06
1

Those IPv6 addresses do not see like nothing to worry about.

Probably just regular browsing that goes through IPv6. I guess you're most likely using either Chrome or FireFox which support Happy Eyeballs (https://en.wikipedia.org/wiki/Happy_Eyeballs), which in summary allows you to connect using the most responsive connection (IPv4 or IPv6), and in this case these sites support IPv6 (Actually Google, Facebook, Akamai are quite big IPv6 supporters) and this may be the reason why your browswer is picking IPv6 over IPv4.

From the addresses you show in your netstat output:

  • 2a03:2880::/32 -> Addresses block assigned to Facebook
  • 2600:1406:3f::/48 -> Addresses block assigned to Akamai
  • 2607:f8b0::/32 -> Addresses block assigned to Google

You can use a BGP Looking glass to have a clue where that address belongs to. For example I recommend you to use HE BGP. For example to check one of those addresses you pointed out: https://bgp.he.net/net/2a03:2880::/32

Hope it helps.

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.